hxxps://teleberta[.]com/#&&yygpKSi20tc3KbEoLc9MzUxMLyvIz8mxTCszT9RLzTRPzDTP1Ssq1beorDLQBwA=?am9kaWUub2JzdEByZXNvbHV0aW9ubGlmZS5jb20uYXU=

Resubmissions

09/10/2023, 00:07

231009-aencpsgg8w 1

09/10/2023, 00:05

231009-adjm5agg7y 1

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2023, 00:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://teleberta.com/#&&yygpKSi20tc3KbEoLc9MzUxMLyvIz8mxTCszT9RLzTRPzDTP1Ssq1beorDLQBwA=?am9kaWUub2JzdEByZXNvbHV0aW9ubGlmZS5jb20uYXU=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
4544	msedge.exe
4544	msedge.exe
2448	identity_helper.exe
2448	identity_helper.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
656	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe
4544	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4544 wrote to memory of 2744	4544	msedge.exe	33
PID 4544 wrote to memory of 2744	4544	msedge.exe	33
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 4980	4544	msedge.exe	89
PID 4544 wrote to memory of 3396	4544	msedge.exe	90
PID 4544 wrote to memory of 3396	4544	msedge.exe	90
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91
PID 4544 wrote to memory of 4756	4544	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://teleberta.com/#&&yygpKSi20tc3KbEoLc9MzUxMLyvIz8mxTCszT9RLzTRPzDTP1Ssq1beorDLQBwA=?am9kaWUub2JzdEByZXNvbHV0aW9ubGlmZS5jb20uYXU=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd39b546f8,0x7ffd39b54708,0x7ffd39b54718
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,16865065734836678317,17144142870138479590,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
864B

MD5
35d3dd1921bdb93b31ed03d806ebb4a9

SHA1
7f8aaac910c2c79773d17ac58c789bd5363ed633

SHA256
c859956c48aee47097f5551a2a953d990523e655adf354434c6c7caa2b4896d5

SHA512
d273b221a828b06ccd61212e81146f0bc10e90e18757e0ee298ab20e100523ae436793c8f1d9a5d27c3fc38036deea6b7be58f899105dd682a3a07a834462fab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e525c817529b3dae8390cc974b93e3f9

SHA1
c9f9d0f4a1f7f282f0cd9f42955282a61f87b133

SHA256
03a6f3a84870460dd4edb20a0b99390ab1183ef8972c7bc1898ca247a6c6c67d

SHA512
e4eae302073fda67c2a135553787228ba5502868c393b98ec865677fc3c36f880fec242dcd6b81fa9e9fa5cd404b1febd7a59d883b8adbb5fc90691e0910eaee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f83633139c7324b0591d2526ab64f82b

SHA1
604614fb356796a49c5b45296df44eb26790e71f

SHA256
da235faf2340549b61a34de1ffc51926cf5a382730159653a5f31f5b8d3fb5bf

SHA512
90cd4fb296dabf5f74d17653cd3b80ae72bce6d91c9a0962e6a540625197d04dee7447e8a453f16077198cb3e0affa5b7664ae72a5f42fdaabbcdbe896da018b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b6c0cabe159c5ef961fc21d0ebae31c0

SHA1
d294131746b27df8fead03ecad9548fc56661f42

SHA256
74c28d43c62749dd2ade4906d5a1b682ee0ab4b70c4da89e9134d9d36b5368bb

SHA512
7e4b25ddd51ddf2499138a489586ac9c3ad4e8323d25621ea639724684a1ac108a2a96a9ccaecd719920706ebb23545395bed980beceed1d19199d8d2080d7da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
481b2a427b6ad38e760700ea17e847cd

SHA1
beeeb16bf0189031dfd1aba4e64f4a3f02aabf69

SHA256
522183f63ab9773e8048d1b30bc46288ce8f04366ba724d028cde79c3b8a0397

SHA512
fba8e8101045df0f1833cace2b965747c9efcd21cc00f474ceca5d6dfdd333b630c59e754b7dc554bfa8fa51752e8a1e977b11b7e96ccc5c2f3fae3f7ac65a68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
836d60ccb76a42ae9bb00c9d0deae750

SHA1
5ea4069b10b4c10cb21c060e77d4e2efbb21ae51

SHA256
ed20d7a5698cb9721016fea9cdbb74c47ac36b0dd5e3868d03fba1dddab0538b

SHA512
0b2fff77f7edac32a22f70db3aa7a585c5cbf225693c9f7e3f4852e3e67e9c342d794f2e50e20b728f4f880800814ca88fbbf75cfd9de50eb629f99a0d941f34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e37aa1e627a2ee519b894c974b97961d

SHA1
05119fe8290f550b924095d39e92cd66edc621be

SHA256
bf74ee035499bc7ea7100492a45534aa02bc92118fd902fb694a3b3683ce3aaf

SHA512
8cbfd1eb03ec1ef44b08acce332c9c3ba555bdc40ecb6a86d200913d9ec663d8faa797edbb9d432640d41b17120027a0fbef808567d7590ddd407b84d8af34ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58179a.TMP

Filesize
1KB

MD5
36c9f29af4211cb11b0d8017cb521704

SHA1
68d4ac3eb80b70dcf7a05ac472043603bd3e493e

SHA256
61f2432c9b6e56d4198780645ca020844311ac3805d000040ec9ba298b0106c5

SHA512
ad1979a8868490a8fc4c661f27da0bf993f34d4e307ae740d41a05a518575150fa9f15b2fe31176dc3465409a5614ac0edc08c26c61d00e4009e09e9f81c6c23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d0400c72af1fa8d14525a2c0d375bbea

SHA1
6df0eb3e2a4517ef3f05125ceb1b017dbcb60b03

SHA256
8b324ec37d566e96e56055de730fc73725974e5931caa9d4a7cdb131fb00ae90

SHA512
29b6bb7c1f48449ab2c6aa6218c1291f6b45bc7f79c76b81af874e60e3f9b1f83b5421b549d92b7ce9be87725169fe9a350107c1f468744f9b76e32bc916575c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f9ec82ec9d40352a791557a891304be6

SHA1
8980f1d7ccb106f3f62707d57ec55b31c03b7c69

SHA256
a9438ea09b626b158dce66d408206a26f1bf08c0db0ffa8ba8ffb9fb5d7bff0d

SHA512
b494ed31740142d224da5477917e69d22e40627d95a604c472befa4ccd3c429e351e0ea3e1296e1061d4b7cea9d87c844e1badfd23542a347b16c2b0e39977d4

Download Submit