hxxps://extremevpn[.]com/blog/free-streaming-sites-movies-tv-shows/#h-1-123chill

Analysis

max time kernel
112s
max time network
112s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
01-08-2024 21:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://extremevpn.com/blog/free-streaming-sites-movies-tv-shows/#h-1-123chill

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3192	msedge.exe
3192	msedge.exe
724	msedge.exe
724	msedge.exe
4772	identity_helper.exe
4772	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3144	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3144	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe
724	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 724 wrote to memory of 2020	724	msedge.exe	83
PID 724 wrote to memory of 2020	724	msedge.exe	83
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 2604	724	msedge.exe	85
PID 724 wrote to memory of 3192	724	msedge.exe	86
PID 724 wrote to memory of 3192	724	msedge.exe	86
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87
PID 724 wrote to memory of 2708	724	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://extremevpn.com/blog/free-streaming-sites-movies-tv-shows/#h-1-123chill
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4d0946f8,0x7ffe4d094708,0x7ffe4d094718
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2288 /prefetch:2
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2168 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5273889832711347009,10424154032100475270,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:2344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x494 0x4b4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8edf5aee848362b3fa4c7102382947c3

SHA1
0ca71672592fef3c37dbf92a155d747c927b433f

SHA256
16594552785f10884854bf38d179c9c3d26d023a089180bfe5a3ceb03c395e6d

SHA512
a8863cfcea01c05938edd34690db467f0d429f0598528f23392ca7e7233a9b2fe2eaf7b886ac965e22e8c63ee79af84654e5b2f7e94033e5f54622f7b9584893

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
78d53c4ecb4f237a195804abc28ebb1e

SHA1
5b036abe11431d0c164cc5427aa7eaaa2d8d1580

SHA256
b1ead24150c5c17d1e8cdfaa64b4395cb1b0872c6f4bb25eb8e024ba0e39c847

SHA512
90c1e12b736dc1a644262a44141f4bd7eb5fe935249978d1ff083e39017652ab847107add5b5fbeec6318db181cd22a728938fba7c384c8023ed8e3c03e61496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000027

Filesize
66KB

MD5
8ee44f09b77ed9476d09536c0dd7a48d

SHA1
4db1f8acff663bc3e886610b6942f5b9f101f833

SHA256
acd79bd8ca501cfc9cddac609056a57a153c3cb170166a361e884176cebdd0f4

SHA512
7ea9137343a7553f26db6928e476f2cf22937d522da896b34d8a2f9434715b923daaf11681599f26720f18843bfcf1be4d87041a027b280ce24116dcc626c1e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
de8611aa54b05907fee051fedb1eda07

SHA1
b73b733f101fa51336ccabcea99bc63e0de6c484

SHA256
9087caf8eaaef8f28377ffd4108481749cc94b4edf1743b19299314f235fb18e

SHA512
b5c62dec24d6afb89e391926d8aa7a5d2e121f6f337b6f0c47e36bbdb4b7b3d64c96a676d649b2fb9e8425345ca5dbca571bda2e2177b18f805eed3c347ffcb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
723c2b59b6abb762a18b324ec07e91c6

SHA1
cb2e48c409f3198a09f27dda905b0a039f65446f

SHA256
818458a0017efcc1affb84e93bed2b415a100627f21ae79450c2da0fc38e51ac

SHA512
166dbb5d68e425d43b6d78871d202b5c1e52c086eef5278ad01a7c855ad9963f22daf9685e59aa131a5f5939814dbe5dd68c4b19af7dc9491eea317898723c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
662908c3467106d6371d7053d7dd77a5

SHA1
354cc0656edc2ab81b76012b961386083c0066f7

SHA256
972d6cc2f7d8910d2f9acc8bbd79ea287ed3134f77aa7abe97b9e6f0853317ca

SHA512
9b339bf3d48e126d18298e9f6258eddc770ee5d2218fec1ccecde15529ee3dc914c1a65456e7f8a5c088b5e9e3dfbb47752896422679215000143b0efd86fead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ba0484f1a1202ebb52f02327985e966c

SHA1
637b8db1c9ad0b4a9dcf4ea8953121b3b62d854a

SHA256
1233fceed9a803c9fba1b709987ce3d120f4132e90d08aed09ed1b47abdd210b

SHA512
164eedbece809e0d30d8c8378845481492175566604da83d1286f83669ff621995da476a92c6171a08a077fa393674210c46411afa8daf70de56400be0b6956c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8abe3ad2f6e8ec541142ab98d1c6fbda

SHA1
47a76737fe66cc37caab436eab4165350afbfe67

SHA256
41f4e6f77558a718ff132e62bcfb54fe7725483a73aa4fb2190c7bbdadee5349

SHA512
a4b7befe1996551ba69e7338b4d73203afa22edf3d3ee605ee04efeac8718b9004c8c20da94dda79bc2b4431a7cff65d4fc2546aeb4860e7e57d5e3fc70cdcc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b0a6325607a1f73d71f1fa6e97a59ad0

SHA1
14cbc76315f4bb1569a8be9f05d72495c30499b0

SHA256
4dbc4b4039ffa2e475c4fd803f78ae4eae712395266e4defbad1279b1246f8e1

SHA512
70ca0787dd1f2376960e9f7abb1fdc0df4590947f75b930b8ec73aff7e94aadb7e10d7e82a55c0be7b8ce8c1ad7dcff149eea5da1938e5e404e3c9f7b3ce3f4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
c9caa86509da177ba21e099e54a36b38

SHA1
bc7117bcfe7fa2fd39fe2efac48377acb92e57ae

SHA256
94ab283ac38690db121f0a00a7f63820d2f1edde80ba053d9d74b569ae3f94b6

SHA512
2d1f858b034b16fd701ed18f9bbde8cf0c50f7ecf3a19ec356d1be2c6fd2b0b8b9f9f2b55b7b39a23f7947363efb33307628b276359d3f0c41da6fc81e0eda02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
8c5879447074bc6fef0bfee5577e75f1

SHA1
90c03c19ddc8009c6586c2efaa377b350435972c

SHA256
d1d9f526e87d1edad9c53539ced1d749a8b84d05c1474af4aa05d39b76db43e1

SHA512
5950c17444175d1e6f18f1ea23e4db3a8c6bba46222ef12010421d61c88c93db00dc6839700adb9735cc4ac182f8f063b01483100f1a2dbdfea0533a78f658a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9323cdb834027f7cb7de82b77364c7c2

SHA1
2807bf31eb4c07608138394eb496a4ade1e23c7d

SHA256
98cb90b7b1dc3e004b78004131c59f124781a9d35a2583e07bee315b50438d2e

SHA512
eb1462d85c06c2aaf5aff87829780cdd399d0e23e32e34a7b8fa2f37ee8d939eb7c4fa7d638e96ca9ca759ace159d1ae4fa990d83169feb367b278b6a07f6334

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8cafed31128c0279d7ef54ba95810078

SHA1
b4638cdb9598b4d32ca2f57fd171bf5cf693fcb8

SHA256
dc1128cb287cd7e73d5fbf999e48b3f46e7d0c5b2d5eef156df9634486831abd

SHA512
e9c25fb659a50908c6a9a5efb1a21d9872b0b3dbda286359cefccbcda3cc4b71275767849394f28de9952c856da854385a3c5987df9d22587fdd704d9be9a81b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
abef04704e4afce0bf070330cef7864b

SHA1
7c701dbd724b3d76bb00b88dcf246c7b39798ab2

SHA256
c360570e66225e3a4100b72b94c62ec75f4cc0da69f4415bc3c0117fa50de448

SHA512
ea4a8856be1d2b3afcadb372f22f571f4c2fb62c3d8cc0841061363de9c5ea3afb131f3f553586662fb192ab52aa49871d6beaea26219dd8ff482178c5654251

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f2b8.TMP

Filesize
1KB

MD5
96da1da3b8de7a54442c6e2b9b8e6998

SHA1
ee81fe814ee33f30a72f1c84cd3f2cd7035a58c5

SHA256
00df455dada6d726d4ad103dab03faf87020bf02044bb300ee59349a4b25e2da

SHA512
deda8b8321e1050803415860fd7dffdb3f13397bfc3ba6ca39bb676f885f229f18260c29f8af2f70ad5f115dca5296dc805eb76b91e79197fe4db6df4db20fa9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
00f49bfb65cbf0c7d5eb67d28d7befa4

SHA1
d83cc9184cc629bba245d00404f2734400c9d27d

SHA256
f9720f0a0bec65db76e64fc7ab046ad9823d0584e3626548e07585948ce8bd96

SHA512
65eb3506092c592c17d50d776809be0d6ff441ef1cfb8e74248bc036d1da6ab66868e6d17397fce86480f9b834d38dcd753c45feb5c41758b823a9b1b77eab6e

Download Submit