hxxps://alphasofts[.]net/dl/

Analysis

max time kernel
1680s
max time network
1788s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
24/08/2024, 13:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://alphasofts.net/dl/

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	6	https://alphasofts.net/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=8b83b8c9d8416628	3

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1136	msedge.exe
1136	msedge.exe
4540	msedge.exe
4540	msedge.exe
1792	msedge.exe
1792	msedge.exe
3728	identity_helper.exe
3728	identity_helper.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe
4540	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4540 wrote to memory of 4292	4540	msedge.exe	80
PID 4540 wrote to memory of 4292	4540	msedge.exe	80
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1148	4540	msedge.exe	81
PID 4540 wrote to memory of 1136	4540	msedge.exe	82
PID 4540 wrote to memory of 1136	4540	msedge.exe	82
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83
PID 4540 wrote to memory of 4840	4540	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://alphasofts.net/dl/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa49bd3cb8,0x7ffa49bd3cc8,0x7ffa49bd3cd8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1920 /prefetch:2
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2880 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1840,8038164785416851117,8240819921974038768,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0487ced0fdfd8d7a8e717211fcd7d709

SHA1
598605311b8ef24b0a2ba2ccfedeecabe7fec901

SHA256
76693c580fd4aadce2419a1b80795bb4ff78d70c1fd4330e777e04159023f571

SHA512
16e1c6e9373b6d5155310f64bb71979601852f18ee3081385c17ffb943ab078ce27cd665fb8d6f3bcc6b98c8325b33403571449fad044e22aa50a3bf52366993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5578283903c07cc737a43625e2cbb093

SHA1
f438ad2bef7125e928fcde43082a20457f5df159

SHA256
7268c7d8375d50096fd5f773a0685ac724c6c2aece7dc273c7eb96b28e2935b2

SHA512
3b29531c0bcc70bfc0b1af147fe64ce0a7c4d3cbadd2dbc58d8937a8291daae320206deb0eb2046c3ffad27e01af5aceca4708539389da102bff4680afaa1601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
6e973acfea5ab0b6645f180680f3c3e8

SHA1
30ad10d750cc7df3233823d5947017a5ddc7fb2f

SHA256
15cd7942d71c709b6ea5911b4d62d620f1e60c03c9b8bf4253beeba027bb0741

SHA512
fec7b7e4eba4ef35f7f0e0f563a2ec0f09cd7cede6aea768279a6836bbedc048716e0ec57ea48450c253b9dbc971104f94edfa66fd8489e6acc4e44e3054ee9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
7d8245256f8043dfa6eefb8befc8019e

SHA1
457f95083abe29bbc9191010a9fba1b918dacb15

SHA256
aa8bcd276f25d84254f02eb3cc07ab9e23372e715b690eb46f0f4c8b3977f871

SHA512
860f8f738845d9b31b56d9804617d7e5d542651c93e1f05a5b296b5f44337f79ad47502a036626bcc8a62da2e008497514e1787f4137f87932305101643272e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
415fd0318708d9e303f028f20a60cc63

SHA1
eee3ea89e26db134a3cbf1f050640d22af357d4c

SHA256
9e887160164e9e84020f472135e6d1932e439107ab5006da8835c146c6ba0b02

SHA512
8a131d80e1a59c4afe39eec87fb71e4a4cad2dadccbae4739d7e67d26211fc088c7ba02417036ebe8c08442a0689329e41c5a4250c235722f01898ac09f59eb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
800294cf42d3e63faf539a9eabda5f5d

SHA1
cd2ed3f06c9466f2f9361d67d68e0148bd40ada8

SHA256
1603d22e73288faaa3ebda6c89d9fddc546916645ae20548bb4930178d0a100d

SHA512
90fd02364b5008a97688cbfbc0a5ed792abf1dec13f46baa40734c983800473372a30383697f0f8333f78efda51ddcb39964c8bfe11ef9e5402930e594953876

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1d9b9d84b01e2c968d3a2411f4872302

SHA1
e24bf2fc27f293935c62e68875ef39c452a70038

SHA256
26eb67844d0d37d4e2b7a47ebe197bbc4110e2cf540f0d6f5cce2d0b692d05ed

SHA512
839ed2082cca5b4bc1e4f62bdb6aceda1be9a754f7e4f39d64af4b305b1ec3f99a146b3ea704f153dc26db0f7963b49ba4530a044780c96281ab6dc1a2eab867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
312f10be9cbdfafa9ba3de94cc754497

SHA1
4be12a0692e6064abe61940320022cd2e9a1bba0

SHA256
6a6cee81e55b803420211749127fe1c95ccb22dae3d9e4e56d9f6947566381b6

SHA512
4a5bd085428efaf7520eba23558c4b748e9ae73e185dc6a488537e6617f1262b3e21f95ab618910b09e28ff8b50ae4afe7011fc321c6c5db54dd4c22695c065f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d94840d398a33f7291e3b7624e0eb581

SHA1
97b7f2238033e15b2287b435843f36592e76981a

SHA256
cb3b50a235db244dbcddaf4506045a450352fda88dd5e8a6a89daa4f1d26eb7e

SHA512
9916aefb04bab87c1d08e7508425c7c995fc5f444e2898a99d368e9043ea20482038f5564bec4e5d4e911cb5d1616875dd6a8bd3b2c99c08c9af713af1bee027

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
75e49b136df943608d1e5adc8833a717

SHA1
d618bb0930cc2fb0153c87df9776a692d5fb1e15

SHA256
9acf96f26310c0fa5af5cf79be44c04c3b59957e5250a6bbc967b06d1978417d

SHA512
a0d62840a27d42018111ed9c96b732dd124583643f73cf987e09e4d874f8e60cd72ce4e6e8e8fd05f78736051c53be4df0493bb4a60de46f0ad0a40b019613c3

Download Submit