hxxp://45[.]79[.]187[.]117/ref/bootstrap[.]min[.]css

Analysis

max time kernel
262s
max time network
275s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2023, 20:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://45.79.187.117/ref/bootstrap.min.css

Score

5^/10

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\InstallService\{4C85FA6A-26B2-423C-898E-D92359A1E340}.catalogItem	svchost.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	svchost.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	svchost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe
4892	msedge.exe
4892	msedge.exe
4420	identity_helper.exe
4420	identity_helper.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 1796	4892	msedge.exe	40
PID 4892 wrote to memory of 1796	4892	msedge.exe	40
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 2384	4892	msedge.exe	88
PID 4892 wrote to memory of 4640	4892	msedge.exe	87
PID 4892 wrote to memory of 4640	4892	msedge.exe	87
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89
PID 4892 wrote to memory of 820	4892	msedge.exe	89

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://45.79.187.117/ref/bootstrap.min.css
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff03b746f8,0x7fff03b74708,0x7fff03b74718
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5104 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:5656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:6132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,18335208846153665457,8239693645180922645,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k netsvcs -p
1⤵
- Drops file in System32 directory
- Checks processor information in registry
- Enumerates system info in registry
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3764

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2484

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b950ebe404eda736e529f1b0a975e8db

SHA1
4d2c020f1aa70e2bcb666a2dd144d1f3588430b8

SHA256
bcc60276d7110e8d002f24d66ebb043c5761e2a4b6ae7854983cef4beacd9bf4

SHA512
6ba228e5b6464c9602db81de8e1189302d0b2aed78a8b06248ccd9f095ede8621fc9d0faed0a7d079b8c7f4d1164b2895c4d0ef99c93cb95bbe210033e40295a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
556803cd47e51b13adfbc3979803989f

SHA1
92c25e0418f4bb3d3ad99338ea0e41e3c647f890

SHA256
975c40f289a5e2b7eae0957da10f10e09ae42d772d857f90261c6cf9a226e867

SHA512
a78a7dd2d92af00d7ef9664e1b075f253aa7ef060ece37d0311549fa1b76918cf2b5ee937b6f4f1b823a480848ee0a76e3c9070a2b80a27a62533015f1c8b6da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bf1198d480bbb24d8fe91427ee8aa5a4

SHA1
ddca2f9719edee0ee3abb3b1862060dd639902b2

SHA256
c232ca1b9597ee693f54c5b132274407367fd0ce8ef44b1b9add0883936e5cca

SHA512
85339078d139a64602f2594bf83a551a4aa593303607bde132e26c5f7e01c212144f7217d5b58e7463580d560617745b45af64bafb905c7d458ca7005a62e5e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a9e9d7e10f7c2d7cb25d051ec07d7abe

SHA1
f820e1b80f720a749a608c34cf6ef9ac223d1c10

SHA256
e7ff1dbb7d0b15de0a605090854e18780946a7e9a9130ce5e4b21e72815bb7ce

SHA512
3e129cd90bdedb379f532fe6cd0bb8d1551ee450e63db769e1473c328e2346e77ca05fe03b344f017c506760bb8c21ba8a2401622a9d2fc0268cc8360a7dc931

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
334c80f884a2941c1165ad6b596ede86

SHA1
6fb4cc2904810b03a45725fa5a9876f2eda5535e

SHA256
e882e7dc0b474a0afc497357bcc8b1a4009bcd14d558d709b382cbee5d00e0e2

SHA512
9b348fd3bf2f5798f86951a5a82ef423cebb17ea425f88494c40a22eba8ffaba3c82c3c9d02f27a7618cdc47930ab095794281e04ee84af3c6576ff050c58c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
464ef7b7b67b16f15c7186ab11f3f357

SHA1
9c27e887196f1b21c1e3702a558a708b3017ddaa

SHA256
33319c76143d4c07ecb54df6c95d6a9deb4ff99c6e999cd8effe24490f8b050c

SHA512
60132a0dd9a4467cb48454f966b713c17426e4de2c60ac3c60cdb3007f8bfff247f8fcec7e9e50b32fc24322bc3c1a14c6fdbbb8360287fb3fcfacbe9bedcf5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
feeacde5e498113f62ee23103fb4a614

SHA1
f538d7e5be7906a22b852443f5b1d352e5e18d80

SHA256
7f08daabf71e599cc1f17769da32a4f28fc6babf71e42906394edaeb69a2944b

SHA512
27835b1d4fcb0b7fb8f1d4b0b6cb703c085d8d3d9cfe4cb5ed79ad625bb7ac55c192b5ea8751e0ce747ecd0f0b5d85105ac742eeafcdb58b77416f0d78dfe927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cbdf3b8bad10e8c01ed3473e08274d5c

SHA1
73fef0f6af9af0558c23336eec2cfa6e4a0f4c87

SHA256
0278ed65b4f09f52ae792432ee6b836599fe095ae903f9cf01258c9384618a1d

SHA512
190c6ccc984063764f4f15052fe1cddbd9b4130d0f154ae852d6d310d030248cb9fd952c3655182fd3cf8de7d292470963dd75bf1c0e8a20f7f87ce7ebf47bac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
ca36933e6dea7aa507a272121b34fdbb

SHA1
3b4741ca0308b345de5ecf6c3565b1dbacb0fb86

SHA256
fd14449eb781c58e6e7196a384caf25cba0c59ebdba3b10f8ca0ecfd0c076b5d

SHA512
5a9b186ecf085765caee97a2910008dda926ce412001042e165184083a52fb5fb70f05ca781cd2f7740ecbd938895c77c5aa0f9eb8d812b92f412f336212720e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
158362bd328777f1747079fd1e2dd134

SHA1
9caeda79a4a80349faa483adf91be50f0fa9e061

SHA256
cc18bba83a57f145998449cdc954f7ad20fd0dc99af3e3af3fd4b6a75b485f3e

SHA512
8a62d0e5d0d15c5216b4583d6799a3e8a071ced220fca5268a136afcb683624d3b7b155369dc5e12cddaffe81e96b6faff33746a57dbf1092af0eb870a05abc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589c1c.TMP

Filesize
868B

MD5
26d7157b62ccad6f8917549a07b03e29

SHA1
73ad1d1240177be23b663ad8c66b2744b767d504

SHA256
c8be368065f9465cadcf974e1ee8b58e7c4f3bc5fdc137048425bf25095198ee

SHA512
2ddc3f449f33ffa1184510f281f441b5ae1f18108e443f35db50195272a3c61206e7c374e311988c199bafac99d8bfb35d1a22dfb111f2c96ea3a0e538c60894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
a40babe302ce2f081b52daf25e67119e

SHA1
95fb46d98b3caf841967c395a5834dabf70fe352

SHA256
6f21ec6584d6f1b251fb1b3a83e5e4fd50ac788891fc0cbc381a641810ef26bd

SHA512
e43dc00a172452d68f2bcc41abd2f274c03fba5c5cafbb9b9aade1295baec5f0a595323714490300a900a0416411f10b994a28b95daf8789ab8e349e470b5c39

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
20cc6985d835da1a55e0b41627e8ad55

SHA1
bac88f9b63e5fc8128778196107a0e765051e2c3

SHA256
aa00151d7465b76524d007e820dc2c8c71ebbaba4f59287debb8536d1550e7db

SHA512
04070beba8aab313945ea81245e025453f897df0f7113ce0c174483aba544199f8611af60ed3ab06f76d7d1a859e0e79aa1a85db730aebb99c0fe583c9c3cd80

Download Submit