hxxps://scard50[.]ru/r

Analysis

max time kernel
365s
max time network
366s
platform
windows11-21h2_x64
resource
win11-20241023-en
resource tags

arch:x64arch:x86image:win11-20241023-enlocale:en-usos:windows11-21h2-x64system
submitted
08-01-2025 19:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://scard50.ru/r

Score

7^/10

discovery phishing

Malware Config

Signatures

A potential corporate email address has been identified in the URL: [email protected]
phishing
A potential corporate email address has been identified in the URL: [email protected]
phishing
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1884	msedge.exe
1884	msedge.exe
3140	msedge.exe
3140	msedge.exe
1932	msedge.exe
1932	msedge.exe
1864	identity_helper.exe
1864	identity_helper.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 2672	3140	msedge.exe	77
PID 3140 wrote to memory of 2672	3140	msedge.exe	77
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 432	3140	msedge.exe	78
PID 3140 wrote to memory of 1884	3140	msedge.exe	79
PID 3140 wrote to memory of 1884	3140	msedge.exe	79
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80
PID 3140 wrote to memory of 1576	3140	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://scard50.ru/r
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe52043cb8,0x7ffe52043cc8,0x7ffe52043cd8
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3964 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1756 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1936,16060149078371362154,6507036868747645773,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5431d6602455a6db6e087223dd47f600

SHA1
27255756dfecd4e0afe4f1185e7708a3d07dea6e

SHA256
7502d9453168c86631fb40ec90567bf80404615d387afc7ec2beb7a075bcc763

SHA512
868f6dcf32ef80459f3ea122b0d2c79191193b5885c86934a97bfec7e64250e10c23e4d00f34c6c2387a04a15f3f266af96e571bbe37077fb374d6d30f35b829

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7bed1eca5620a49f52232fd55246d09a

SHA1
e429d9d401099a1917a6fb31ab2cf65fcee22030

SHA256
49c484f08c5e22ee6bec6d23681b26b0426ee37b54020f823a2908ab7d0d805e

SHA512
afc8f0b5b95d593f863ad32186d1af4ca333710bcfba86416800e79528616e7b15f8813a20c2cfa9d13688c151bf8c85db454a9eb5c956d6e49db84b4b222ee8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
937b4a05f206ab4f13bf09282b2959e9

SHA1
4a8e05639421c58013dba9dd8ae2e7ad8084aa10

SHA256
5814d0c7fd9b18ffd9886903bf26b3778a24095f12ad47ee362ad8dd3497b3d0

SHA512
ecbc524d7063ae188f85ca548e375b72084aa2872c335280a04ff974ad9122589dfd19560c3b6bb169f0feaefcd83624a3ced272279eb68032fa5ca977bd39aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
543B

MD5
0e0399c06cf8d1f999c7aea07238237f

SHA1
64e786e5f65df8ad66e98f732cb1a21d8ec89b39

SHA256
3e963c25450f29c2877e3b8016a0a4cd5867246f125ccc6be931397cac05f7b2

SHA512
2c4a4223ec8b462aea4799e823e630696eae7f2f849e4c19a714304ded104196616c8faf1ef76073a8511484f7f4d8007bff5c452a39ab4ddae3a4274839a099

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
832B

MD5
48a247aae7995813644c1505d92c2f62

SHA1
89cdc8dc237bd666fe0d0aabcd89df9f2d4b83a2

SHA256
92e19dfc0fbc4c84431ab34816d43cd9350cb99502a6b04ee631fdb1c9e59ff0

SHA512
7d8bb6399918666e277fb89a2e027a6dfee049a09d2285ca85684546a0106db00a6de5917185a9d1126fd3e96197141ee6bb241d6a3e56a381585d15b3ecf5ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e0bd62f0948c28bd7a724fbf3ae7f663

SHA1
4c9b173f6cc8e4bed6d11e6f67522678003a01f0

SHA256
bbd5efd552b4da306b5457f54dc264ad75fd44834be95a1bc75e66fe3ec9b14c

SHA512
f36d8b2682469d35ac30ee0cd8c08a04092b4e4316cef7bf9831b93fb56ab3ec8853cc80c9fbd6ee3b3b6dc11d0f7763b2e8fa9c0d539815c11d72ee51c19993

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7dff60fd0f44404c18db25c795d24ed4

SHA1
d4eaac7dd57f9a5f679b6722a159ca7352ea352e

SHA256
3f8fc6d0822a36caa2f02a3688cc58584b1854143a0ece832a5ce1080473b461

SHA512
5ac5461a2feb7a47c0193ea4467a8e53ebf32d1d0fb8fb87101ef76a9cdd2e1129506d0fbb503355af66506811f74d9e838180b092df18181f5fac02c558aab3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
31d5a0af5b0ea96034d77920bcdf5aeb

SHA1
f5221d18a4d05739af12c9c19fd8636198a60197

SHA256
d556d5346867df60993917a9ad131a35134c11810e22b3e75fd9d199bec86444

SHA512
b8a525c6c41447983dae926ffbb0b8918b8ff11ea49bb01bb6d56cb13b4030657dfd85ac0b0a823cf77605540547a0cce12d7294880de20adc1e1baa90640f44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c464592d55a429c8100dd141f273e08a

SHA1
2941c50b5e5a8623dadbeae5322d46f7791c324f

SHA256
ac9cc81a41f40ad520cc6539320ab271bb9ae43c71d08151a361f2bc57736932

SHA512
5f96d731f07f3ec8f6a70fbd203a490ae97e7ed8ab11c28b81b432718beae0795fc21770ed9d6f59df27ca4a6a35a251ed20a1594b4cb45ac6d068de1126c6c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bf065624cba0f681ece6aff4265aa138

SHA1
464e6468078662538f01531da73d7fb826328a9f

SHA256
e881a60fb27e1ad5cc1f8219f522674eed8b0163fa17df42a22ff3046753bb95

SHA512
61fe5fd09d6cf19d079ac6cdfa69850b2bb11c6e653d4647ceb5779b027ac30e15c100acb42b0840eb1941f3607cbfb0a1d893dd4756babbd80ba5b74ef50824

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9fe02a22516930f982baa6d2f59d2e3d

SHA1
1f51995ed852b6cdd819f593ac174bc105e89308

SHA256
5a854f5cce9cf7864ae17cef6d1b4a56e7dfd5a428885b70cb5f778029c6d547

SHA512
4a56817b669686671237022d0c9f80bf56b1dc5b2104636dc2770bc7c0dfdf27dbe26451b82a81a9770eedc7f0caa381b962c8fe26321f6bcbf6c9046d783e4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
370B

MD5
f202941786292124bc376a47030c061e

SHA1
1965eadea093e5e83707812df2f6d7edc09c74c5

SHA256
1b5e1b8885bd6e0c9c8ff46ac64f22f69234194046253621e7af39efda8399e8

SHA512
984977a36bd11e7dc9ed60863b0bbc8547ca9bd2f82651e12ba7756112bd81b06a407d89f1aad45b741ecc3309be9c5928d9aa2a8a11c4c3a3c8777f1beedcd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe608159.TMP

Filesize
370B

MD5
577fbf9d66974ad0c9f11ac2df7c85a1

SHA1
86bcb901bb887af02f71ba0f65f49dc8e200a02f

SHA256
64ab40ee262c2e0173f38ac76dc0dd2a7b01061167d8079941dd7b9a74422892

SHA512
251a646c84a36041a0dfe60d48fe58d3b86d3fd05c47d7512a9364a7faceb411649ea252144d4876ab4734a215854604ed5b8bc175cab0df3ee7e26d376e78da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a2c3f927ec86a124db8e1b7cff9e9920

SHA1
c56e27b695bb69e2acad753da8875566883ec33d

SHA256
446095ce00e0c72e69b93e67d34b5c9d64a09af31b55857cfbbc6d4fe0a30407

SHA512
94313cfb71f9aef76a0b70b24a1d52a70e6a236d9c12cfdf2d9370b662d9a86093648b30d4db1b1476b11f34ca1b31c55fb155e349dd80537d0c7e6b504e4f94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
21df52e7dc4f7f8459b5f56922e4df02

SHA1
0fab9aaf90487217e7b40c2178075022760d4353

SHA256
bcf42744f34daf26010592c3237394d35b8554b86a16574325a15879274d6396

SHA512
bf2358d2f566af117afae9495938660a1e6f8646dc6c5bed0b08ad16338fb43b97ff1901ff24bb6bf1fa9c905944a38cd6c367d6e1f30f99fabb0fa4355d71a0

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit