hxxp://1v1[.]lol

Analysis

max time kernel
149s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 03:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://1v1.lol

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-945322488-2060912225-3527527000-1000\{3326089C-9A5B-4C2B-A9F9-E5A66E4AD4FE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1964	msedge.exe
1964	msedge.exe
3076	msedge.exe
3076	msedge.exe
4380	msedge.exe
4380	msedge.exe
4084	identity_helper.exe
4084	identity_helper.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe
5752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3916	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3916	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe
3076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 3660	3076	msedge.exe	84
PID 3076 wrote to memory of 3660	3076	msedge.exe	84
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1952	3076	msedge.exe	85
PID 3076 wrote to memory of 1964	3076	msedge.exe	86
PID 3076 wrote to memory of 1964	3076	msedge.exe	86
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87
PID 3076 wrote to memory of 2752	3076	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://1v1.lol
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9da7946f8,0x7ff9da794708,0x7ff9da794718
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3984 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4972 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2620 /prefetch:2
  2⤵
  PID:5148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,15442337531251337687,12779559617331882458,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4c8 0x324
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3608

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
efc82ffc0e084b0d371fbd578fd1c9ff

SHA1
3e9fbc0b970c3d8a1351d21f534e8eecdce200d6

SHA256
e2c5d97a12452dcf9fe62a88b938ab0d0ed28125e040a2c5fba30c13ebb6aafb

SHA512
e107e4035a23a6d1d2bd648c7283fa91553a37ff58dcba020c32a22df231d3a99533aa14a816250836cacedb9338235459a0e0a1908812a109b2ea6dc7570394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_1v1.lol_0.indexeddb.blob\5\00\1f

Filesize
1.6MB

MD5
dfeac47f9f881bd1e4fad42efed539d1

SHA1
7e8bafdc61da7105e9cd208ac3a651bc0ee48567

SHA256
ed404198acd0271323a7eb6b76898272bdaa2786ba197d795036b6c0f7146b47

SHA512
d916420a62c8a387fd29cd87959bb0bfb09564f4c30151dca293f2bedf0d87ada7bf9324e3178cb066077430730034b0b918b17dc3133d9f7b44639f351aad92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_1v1.lol_0.indexeddb.blob\5\00\20

Filesize
1.8MB

MD5
cdad4d089f5b65e4d709b1d559166623

SHA1
9de7913916f33b8d53bd3709ea9c405b5f7f71fc

SHA256
850bc027a6374ee948e541ca53e2fe96ff50e382d7508191453675503aa585e2

SHA512
eec2bcb35ec6c2fafcbc514cc4c160c8adab0a720d7f80283b260b523b296cd891a3a7c292a412c5f83aa547d22ed68f8d120b5a67c05df68ca3fca1c97d6add

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_1v1.lol_0.indexeddb.blob\5\00\25

Filesize
15.6MB

MD5
bee66a41b566e38d3e01515d2a5a79e4

SHA1
a7b3f8e0f38ff731f96cde82f84578ceec65836b

SHA256
3a1cfcfd90240611dd5d4268267e0d3481082a02f92eb6e374820ecf194ba76d

SHA512
773f01ab271db5275944c61162eeeac6a6917542d1cf8884da12547894e2980a959ace014d500b1d922f04ea2d182f6bfceb86c3851909d763cc9ed98f112295

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_1v1.lol_0.indexeddb.blob\5\00\3c

Filesize
74KB

MD5
8d561831b42b220233261196c40b1d47

SHA1
2585fd13db839e6b55fbb62204fe08686bc9c1e3

SHA256
bc0d9729193fd45bef0590da96dd7e5710c16bbb9b854492d935b1c55a84ed31

SHA512
f78743e106a0360cec9270cb9dc91fbe731ef1b86d7da1c65992fd1a950a27061f8041a9058b45f4313caf7680c9017c5e6973f107fc35edf85080a589f909d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
d924580865fa170859d4666d7155c3af

SHA1
be56c7d42c2c8826cb13e2c349d783f9f21ce152

SHA256
dcb9b2b635740045165cec68f1d43735916384039f78b4e4880a2d42ad12a74b

SHA512
8902f607255b922142b8d0a68e001d48421b66549b347969211cfd55915a0d4bd4db88484dc45cd3221fec30c117b3dd6a6db468b0e96545bc1a7464ddef36d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6bf3d5eaaea57a4c6579f7331709d164

SHA1
ed8a1ca006131eaa57b94ab3066cf24bae4f28de

SHA256
b926a93812b7553b3ea72acfbe116f00b68b38d4b809c9f3babef9238c480ac3

SHA512
f77650272524ff58863e9e8a09b17a1bffff2c72fcb6792ba6c152305cd663f60ca5fe486572a0e3deff2a36b97f2cd0a373c9c8fd08e4fa0ef1201b9ba1ffe4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cab6fe945cc8d405912c2e4088791b88

SHA1
e5e126909c8fd85089e7d6b8e96860e4be8a77b6

SHA256
e12b3f7bee059d9b2b1f481f7eb5b409188699f38b1fc9e28fadc5fa28ab91ec

SHA512
cc394034049094da4311aae9a41ae9c1d5b52ff0027e2d8ef6ab0042090df87772c2426b495c36b4eec15c3d00d75bba83d2a67be5c9e555c1fe45ddb513e424

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ce8c7a1e81abb36ca0fb9d5d90defb08

SHA1
4c9eab33a797265d9ec9edba34625b059efdebc7

SHA256
ed9d108f633694eff856c5be13c154f9bea32c6d3c1b755167e9425bfe31fe00

SHA512
4460d9b8785b3c6a9bf3724145530e2bd3464a24d7c4a3d0e306681c7e43077032081ff528fdbae57c848d7ddf6756a5670489bf112191be252d6280ffca8954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
9bc4ba78a45d77bd986ab42ab708c21c

SHA1
e7d455b5f62c20ffd0d0d3867de8b34a0fd0d2db

SHA256
895c58c41eb422dd91b08635384af08a501811f5fb62c5b1023042d10d1397e2

SHA512
2c8acb7056b3f61681502b5fd96ed5a9e998f3d12848be71ff32871eccb0a5094b24beec0064206b2a47d7f424b9939d662cc7a826620ca434b2931aa113e54a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b4e388db3cb371e2855d357dbd6c0b5b

SHA1
435b7f0a99cb3f51865b81b651b64e3eba61ad71

SHA256
81eb8c08b88f63b87b0e5790bf51eb3e5443abd0483e7a8378ee0577b9ad348a

SHA512
f00c4305d0838050032f4e0c318ab14ce48a3b4fe7338675250db28ea0d2be42bc1d1f9f638e3ade58752915da91f4c950562dd8fed07f222cbecde8b4839a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
97a0cf80094551758bf92c8980aae808

SHA1
1b0199089e55e4b4673d94d55fd775dd5b54f152

SHA256
86728a4320b91c6a3018408a0568b1d6525eccb8ffd20824f83aa33361b4dd44

SHA512
390f30f9e718fa4c4c79674124bdf30e3273c3b1ef413a52b7c5e4ba75e935cae21ee2f34ab6831deaa90f8fcf5ad617c7de15535607e48b1f850865697c5583

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580e24.TMP

Filesize
705B

MD5
289dacc22271ac8e337a0cafa0053f09

SHA1
965f5b1a3fc6f850688c9753cbba7881d1c413bc

SHA256
7631d766e0d5526d55530929b7021c9414d73c33d4e685a10050698a4198638d

SHA512
880c806f5551959bbed1f9ae30660f57879934294419e9782f8da46897c476a10e0328d54aeb3abbc252e545c529497501712e404f7c8c08f989b659db23f983

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e81cff44c0ad55245808bf316bd2b6be

SHA1
24e37e3dcec51421812e15299343fde13236759b

SHA256
e93b9e438ead73205ad416d8aeb127de2eb90463f03aa1a35f30271a45a8d2eb

SHA512
95122aeea00c4b585bd9204438a1c7f41cd0bf9762719368c7e9c3d7084e9d944f13969f26173603e0d9c5b4cc38b57f095ed91a1322696309774a94b60d718e

Download Submit