hxxp://melbet[.]com

max time kernel
148s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20250217-en
resource tags

arch:x64arch:x86image:win11-20250217-enlocale:en-usos:windows11-21h2-x64system
submitted
05/03/2025, 17:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://melbet.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4720	msedge.exe
4720	msedge.exe
3088	identity_helper.exe
3088	identity_helper.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe
3580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe
4804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4804 wrote to memory of 4248	4804	msedge.exe	81
PID 4804 wrote to memory of 4248	4804	msedge.exe	81
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 3952	4804	msedge.exe	82
PID 4804 wrote to memory of 4060	4804	msedge.exe	83
PID 4804 wrote to memory of 4060	4804	msedge.exe	83
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84
PID 4804 wrote to memory of 1252	4804	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://melbet.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffe6aae3cb8,0x7ffe6aae3cc8,0x7ffe6aae3cd8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2356 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5724 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6184 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6748 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,4650353375628827007,6169525860850256642,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=6660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
46ec2d399c9d10a0545cb514e47de14e

SHA1
98fc6f3f34f4082b8d81cc50dc571ec06eb454ca

SHA256
f50fff32b15e4b61c3cb18655c3daf46a83556aef1f3ff8d9ed074f298f247a5

SHA512
993b723da7b0ffcaa731a1f06057bf2ebdc2fd518ef8765b4f625b9fd0094cc6abdccfe998d0e6cb760a3e5d6c411b197a47e67c1de5a6ec4315d017a552a2be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a1ea058d6231b47f5bb8557adba13351

SHA1
111dbb6ffff6517e11719a20683fd7f4ef0579d2

SHA256
f5a91a0770c54a1601557b8babfcc7813972275da171c384cc8929d2910a851f

SHA512
e613f481c50b5a7022a763d13ac1b1ebb6a9d4d973de95108d95d23844d9d526d8c90f391493f043e86e22e9a5abd8a3a4cab5f2def248033d0eb9421091889b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
5aa54702baef2b8d588b444fe70e17cb

SHA1
db1647acdc083d0b8b2d148e1a04dc5ecb7af6f0

SHA256
29541ec373342966cbcbca471bcdbf76cee9c1bd9170bd487d9a522a2efc21ea

SHA512
5c50463732d4a76cf4ceca7c3ca1f9c71b5dbbec5f297390f93b406127844339f730b25794063559e3ce858c5d63ba9c93276af1ce980250c3bc3ee3d74a7e8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
a6ae33bbd1ade911808af7a1d34efc14

SHA1
b695abfe981246114eb1a012cda87ba26bd9a8f3

SHA256
d30660fb6498ec457f2df29ac0aafe664548b894e5ffc55caef3c9c60a93e63b

SHA512
2b368bafff5c48ab7e6c8c5c160568ec028f6e96a80037ca052e8b373ee9b1ab535eafe4d90a7d07d0b2877362f62b5ce1c4fcfc48e07be351d903775e623631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\MANIFEST-000001

Filesize
41B

MD5
5af87dfd673ba2115e2fcf5cfdb727ab

SHA1
d5b5bbf396dc291274584ef71f444f420b6056f1

SHA256
f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4

SHA512
de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f489c2825abd6f6abd005b8fcf287b87

SHA1
5b5ed3dcf56e2df17739d00bc491600291fdca0c

SHA256
67fee55b80dc70f9e0a628b37b2a9380e1b0c02f32624ab9a1f2149671a4b174

SHA512
a8e8180e34e468960ca65b4f23e774fbcc50b1156336dfc67c60855042f9fcf9dd190e3988f63eb3be6341e5982cdb1a33d56e9783c448dec2f1def2f00bb076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6e490617127b5ac46dbd08c6780344a9

SHA1
d5fe0aa6cf3764d415af3e86ba10fc1c39bdd48a

SHA256
374d14842746746839908019bb8e001981036b8aca968a6d30d3cd90e7455119

SHA512
373a59f87f75870b3dcc785c6e1ef2d20d2ec3ddb7e669614a8025bc42ace4b533a3aebd39b630ee30e60a4710feae599c4de037dea00c32db4e034beb01dc1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
fc2ff2977db65eda6ce6c3e860c605f1

SHA1
dede116a6f54df2c76ed13f55a678690f3b7821f

SHA256
63fbacab36bc3fcfeba6c0308257dcd1467ce0f652bc1db1c079379659c3893f

SHA512
8121498ccde9d1627a417a50ffc288ac30111d48c349e6f6f704804058557d502c5357a05b9b0d36b10f369f896bf5e219c5e3e77e843d65cebd23adf5171698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b3bf11096888ee5a9bf1f8a9b4b4e449

SHA1
aad1ea240c6057017154db4f33dfc54b352c3a8b

SHA256
358e43587882b0ca38f7180704f26613dfe2ee87238079f65fd4af84b97c2448

SHA512
c2f42dd5d512b3105a49d7bd3d27514bf87912a60b110113a09ef7266096bb14a709b2e8ee591ff5426912fe376764aadfbe54068ac66b7b3f64481bbfc99fbb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9561845e757097b7a88e48ddc97ef1c0

SHA1
f8c993dc0515964c4aea8b7fe1ad6588811e84d9

SHA256
142d6ddbfa53e3411d032cf99268fbe8d0ffea84c00da66904b95510ac1ed30e

SHA512
633c3588244cd5d4dd8d5bcf45ad76bf77276879943c304344fcd6cecedc7664db539021a049a4c810b2cfd2f2c7d24bef2ed29cf7caa1568a65efd2a8cba8ad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
91d1b4f6d83325ce92514b7874b420c6

SHA1
84d6c15488813a0e4bf20fb29d8b41f56a64690f

SHA256
7a11d82a8a70fd1ed2892c406599caaf0f1de3ac2b861bc4545b881cfb32f093

SHA512
357c39fdaeffd3b49c5a4f6d3d14d95a8d5b11a107a5b52a024077a5df130c8ea57bcf32eb902eb7c690f85577d714bd0f3aa924afa7aa457cc036f12b615e46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
628e72cd5f939e51f6dff850c238361e

SHA1
764979695dcdcfeda1ce002bdb5ea646d0c258cd

SHA256
1998083d1ab3897addf76eabcc1f646c360d8366fbb770a61ddbc0be937f9777

SHA512
bb115fdd7dd4873e0f09d6727f69575f4fd5e5233dbc10b56872a5ca7640f12054729a96b42cad452e1e21f73e0295f99d9e18eb2b69f3af5f40153fe321733d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5838de.TMP

Filesize
48B

MD5
c9d81cb94199ef26c4150ec75ba9819b

SHA1
64c6a68e43f06ebe77efb100279bf4ca5d6b12b9

SHA256
23713ea1e391c64f6cd122d62402dfcf6a7b41cec49b5eb30f62bee3f36ac3fb

SHA512
416c30d984705c9ec35c157068123e865a859caa81cd60eebc1508d664a42e4194fdfb7f07fbfcf679a22c1b52c73db73daf1dcf1fce0edc9e96af5c3a7c9584

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
f4170f226dcb955bf92cc7dab4d5491d

SHA1
607e5615c2000e3678a8328f66aca62142d32e74

SHA256
7b1da7c58b69c03019ea682dd16627756a207f7a2078ee46d7e0d09ed3f5c681

SHA512
8e2fd167162b220c56d376a0ce347684d338dd344f725675f2341e5f96f00a67fa4540f2ff660343b2928636018dc22e1ef8920c3ed9cf0c7abbf614c80119bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2eb2ec710bb431b6f96bf69d2106e642

SHA1
1b19526986dbd76f81f6d7d930bc44d322278b86

SHA256
cf73c45cf2f9cab85b6e7d526ac4191158b39a3f33b1d80868c18c18513d9056

SHA512
a5140de7353d24c3cdbb7d77ee15a4b0e1089361bec41387006a6aa9a64666d377736053aa6c51e4fd88517b13b4fc15c452fecc5be1db6bd458f0f43da995d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580887.TMP

Filesize
370B

MD5
90cb61f7e952a60f5142d52649a171b9

SHA1
f3ccc29ad97395435a3d7934c05831942f5bcf1f

SHA256
9946bb037f2e48b7a418e40ea4c726ea8891ef6c36d4f133f258327977953e4e

SHA512
3fb07fe0e0f221c8ec98da5ccd3b63fd32c022c2f7706bfd58c0f0b187b2e0dfa0886b8052012998468b66483534423af210084fcdc64a5f0c5e383beb573ca2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7dc1d5729f5aad60488fddb91e28895f

SHA1
ea5a79e6cf7c10290dac93bb93c45b0c41e8f3e4

SHA256
381660fd6b48ea39d027fd0a447d00dba5a72bf8e2b03c024d06ba677760fe98

SHA512
c54895a3d2b7d5bdd3cafeb8e715b00344a9e51b8bf1b8593ebe32b0bf7352c4f272aa6322bba755e48261297159f32ab1a5a24dae5cc7dd216caa3d78ba4140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\c7c1507e-43e2-4d30-abcd-56fec4a2422a.tmp

Filesize
11KB

MD5
243f263d645cb066760c90d7216a53f3

SHA1
047bc1e5d7124a0eac522baceb7d188ae78a2ab2

SHA256
6e8dd4ed63f3cab08c112809793f07901ee8e88b19bf80358049f97f7d7cc4b1

SHA512
07e098f169040e46dc383f38b907d0038f79c403a1b8904859579401be183c799d451b2ed7faa5d18bb1e34871940b396da2164bc2a28dbf53798ce3837daca4

Download Submit