hxxp://deledo[.]com

Analysis

max time kernel
139s
max time network
141s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
22/08/2024, 13:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://deledo.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-131918955-2378418313-883382443-1000\{63BCBDB3-F1EC-4CD3-BB27-78D411E11145}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4932	msedge.exe
4932	msedge.exe
3532	msedge.exe
3532	msedge.exe
3556	identity_helper.exe
3556	identity_helper.exe
660	msedge.exe
660	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe
3088	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe
4932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 824	4932	msedge.exe	80
PID 4932 wrote to memory of 824	4932	msedge.exe	80
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 3560	4932	msedge.exe	83
PID 4932 wrote to memory of 4036	4932	msedge.exe	84
PID 4932 wrote to memory of 4036	4932	msedge.exe	84
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85
PID 4932 wrote to memory of 2116	4932	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://deledo.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbe96c3cb8,0x7ffbe96c3cc8,0x7ffbe96c3cd8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1836 /prefetch:2
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2140 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2476 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6248 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3324 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=3304 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1728,5589009579464159262,14413798996681591801,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
b54697774a02c0857f4abd07cf2418f7

SHA1
5ecb7767ce96d28055659a4686c776ea9e7322b7

SHA256
bfcc1093adccbd4166834b0ab0f9bd6f758ac838f8c4ccff8ef9c4826546bd30

SHA512
c204e43608e8f2af577bab1fb4d8bc5d73a4cf163f94b157da6bfc1e74270981c1e86ac9c637005ce6876f164f9d7c0055826b1999c24592aa4cebff364ffe8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e681bda746d695b173a54033103efa8

SHA1
ae07be487e65914bb068174b99660fb8deb11a1d

SHA256
fee5f7377e5ca213c1d8d7827b788723d0dd2538e7ce3f35581fc613fde834c2

SHA512
0f4381c769d4ae18ff3ac93fd97e8d879043b8ec825611db27f08bd44c08babc1710672c3f93435a61e40db1ccbf5b74c6363aaaf5f4a7fc95a6a7786d1aced8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9f081a02d8bbd5d800828ed8c769f5d9

SHA1
978d807096b7e7a4962a001b7bba6b2e77ce419a

SHA256
a7645e1b16115e9afec86efa139d35d5fecc6c5c7c59174c9901b4213b1fae0e

SHA512
7f3045f276f5bd8d3c65a23592419c3b98f1311c214c8e54a4dfe09122a08afb08ab7967b49bd413bc748ce6363658640bc87958d5e0a78974680a8f9beadf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
35KB

MD5
ab412784919b288323d62a779b8617bf

SHA1
f59fbb08df71ea19a435d5aaa34b60b2ea83247a

SHA256
063517e0975f657e7c0a8b80fff85c5ba4a5a1860a97e49130ae0b2e8bda33ce

SHA512
74aaaa4fb65cb11ae89eb74b983f0c4ef53a9ced45697392327c2f443a851ba57ca483d56cd94d76a6e4db3e043b795d2bf7603cff03f2cb860b6bc660aa3e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
8c7c2f6a79fbd146692c68ba75bf5cc0

SHA1
a5746166f2a1ea7b3ccd39eef8dc44522814baa8

SHA256
988ba6915860df865e49b12260f93f75cd42355fe80e2a66759322509bea2498

SHA512
e16acaf05fcb69feaaefb7b9793501836c136651658255075455303f75c00da8c09d1eff9a9cf4f825e5859f3a19db8b712bda851d84028f9e3931ce461de1f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
3e7b2266108f118d6ac8881af74f132e

SHA1
a2976a05082db6dbc2e1057af1991f4d1c904f05

SHA256
1f2403c0cc92932ab5f7eb0b99c66b5214f54fabcb27a77a05e01ee18a88714d

SHA512
a8459de5594cc141b7cb5192f2bc3a7f7ccfacacc6b6115a14341de14b1027d41ce430f72c1d2172ad93fdf3d166887c09f76c79d561728a20b2ae4c997a74e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
7487b4febab3730ce54742764feb611f

SHA1
f3df0ae76eded41b92e1edc2d3949ef5d8a88ae8

SHA256
1f4518cb584684ffdf85fce65c651ad77962c83e383548df08bd37071ac35744

SHA512
dd3212bd1ff35b1241a1a2a47bcb3397bc9c3bdd802c4d4d249fbbf975c610ec3a6c3762b495ef969c8b49418e375e78b7e1bb171d196984e78a97412ec1d1a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
6KB

MD5
cf9dc22bc2ae227124237c9383bbaad1

SHA1
501d49a87648f215285bde581edb59c7d1aa940b

SHA256
ce2d4bc69f17be3e0b48edb1c6e453dbebe657725e0fe5669a0326338483f037

SHA512
2186d09deda39abd0cd6f7c2ba6b5a6b37f0dc34dcefe72ae05e6ca12e217fd98e498e64db898b1792cd29c8e654f45b9fc86f285f94e23f2ea96478e1aa943f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3066087b0d43cae43800fe5996099788

SHA1
cb52c865ab046b217b56c398a16a95b40b3a89bc

SHA256
860b6114cef186341f4547b191183f805727147aebc434d5af4a671c9ca6e0db

SHA512
b53eb9f08ac98089b6d16ad81de357d518fe036fe6543fafa1ff606e3828cefac97a126acaf17592563978b3475f8385ee885ff3db0cbc81abbf728058d7c16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
20f09b1b92a6e31e6bb023aa173088fb

SHA1
a3965ce62c0e4b7a1ca629036244d98f582a8d07

SHA256
08a70580278caa692ab4258739e7742ba041d9651c07ba9b056b0e181f802a01

SHA512
70866d611c6f6035b57a109140bc1a5a29a87a44a7d3da9cb8e0e5cb63962be8fa0d999b81228e8b063567450818bf58ff993765c81eb4c41259a31cf103bd65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ab2e270d8b3605fc3351b945f22c2c68

SHA1
733d9da6cbef44565dcf86745e1fbc3d47835a73

SHA256
a032677940db9d1f680b20ae62fa6b7d49ade9437191638c616dea15cb770310

SHA512
52f6d34075e948066b73fb861430cc6b346edcd5a09d99daac42add1d9ef0119492fd150d7b1ea938d5be1059bf451a9b06cb9c73d86e830ab3b1116a1ad0276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
771f12899bd0ffb784a1c678479764cc

SHA1
9aeae159aee31025015f4a592b8444da7d51ed17

SHA256
4057ef19b45fde7ca09fd60b203d4c3197b327878b9e9247e96beb9243c5f992

SHA512
fd7d9dbce09902f7bbdce7114caf8e24ad9282a4a493822c1743d32fbbc92c208435e13e38704a73bca18421f39726285cf79aba4b03db18648c8c549acd872a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
dec7f068baa67c69afcc0947d8b7a8d1

SHA1
cf331362f0bf5bb9b13731288a20df2aebb189b3

SHA256
69c2d72a526e0e628393d9bdb3ca11d312343852c3ec6236ef462b6ad9e9ae40

SHA512
c2b7ce490c38756e9e7be02a89ceb69de52f2b7ae8df6debcfb8493fa563882b413c1a91688c7e417214ff1e543713f79ace8048c57d6ec6e4f0bd7ebd6e86dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
88dd2c162a22bdf5e82409f179e207b9

SHA1
92e4d92fd5304057233b70b217a2a899fa1e8eb3

SHA256
dac33c5339f4d7331570611b71da353d6b10b961aa0ee600e9376b373ce2a3d6

SHA512
85c8b97551f5fc848cbf1a0bc20617eb7d48442a3b6bfeb7e4f20b2c68136725110777573724a112fc5f99703b919ac4c773093611cfd3eb703f8f8999ebfbb8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
104dc4a93385e9890ca48d67177fa409

SHA1
8e1ef75754b4dbb4443b7033fc1ddd30258b0c9c

SHA256
6dcf0c36cffbe58df7df0ddb65eff29562157411f706a927e8e83a694c792334

SHA512
e8d197b4de46cb5480663377cd4ce39ed6ff395ffd12554a607d6454ae22a05bc0aa127555b709538f5eaa00990c113303f7b110623f4c13a7bb562d70341101

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ec92.TMP

Filesize
705B

MD5
69a968ce6126a2856346b4368aff3bdd

SHA1
ed089e22bb35688c5a19f41bbe54bebe09bd1fe4

SHA256
488d7ba7900ea51c9e132c925b939b75e5fd56d82332c773471ce0fa86a8eb4c

SHA512
39edaf8333d98cf6e47c74319bcaa47ebb5de1b7a6a38e132b376644751f8f8b2d2af1f831fba550944779700a63a17d780143802206d021b1412167d19414bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86cbff608a0bdd63aff2a21368454b8f

SHA1
38702f1359363cc5816526fb6c92351e70c91227

SHA256
15798ebba99e11134d7c7b657649781b9c61793b02ba5435345a3140be017fa0

SHA512
40de7ab6db8cf82ab07c748b7ad6dcbdf5695fce26d7f76051014ff88103589bb711d389d8d051d66a8106bc504faead3f9f00ef9cd6d29857246a68d7546bf1

Download Submit