hxxp://www[.]midgeure[.]co[.]uk

Analysis

max time kernel
97s
max time network
108s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
12/02/2024, 14:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.midgeure.co.uk

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3052	msedge.exe
3052	msedge.exe
3216	msedge.exe
3216	msedge.exe
3556	identity_helper.exe
3556	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe
3216	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3216 wrote to memory of 2600	3216	msedge.exe	84
PID 3216 wrote to memory of 2600	3216	msedge.exe	84
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 4620	3216	msedge.exe	86
PID 3216 wrote to memory of 3052	3216	msedge.exe	85
PID 3216 wrote to memory of 3052	3216	msedge.exe	85
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87
PID 3216 wrote to memory of 5096	3216	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.midgeure.co.uk
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffeccba46f8,0x7ffeccba4708,0x7ffeccba4718
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,11962153685560642093,5034027814922889249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:3676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
102KB

MD5
e1c894bf3fbd58b78d850ce33d6f3983

SHA1
08d182fede0e0f35c2d3937dad01b695f7f805d9

SHA256
4e3e0243085becdecfd2e3cbbaa3ac44c3f66b994315796dcf7a6b9e09d703ad

SHA512
177508aaf0b27631c3d038cd4652e93a879095f7e0bd6d295be33790dd16a91015eb0b84627a349c76c8b30029e03c4c41b199f5f680a39ca4439800db750792

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000044

Filesize
33KB

MD5
27a05b77e7bba6c2b279f1a67cd6acef

SHA1
3164de3d460475f745bba673aecd9f7d799d7509

SHA256
71aca97ad43f1a016bcc6a04f90587cba90db71a03358130d686acf042e00f83

SHA512
5cdf58d637dc70be10b36d7ca7230404ca4cd58af53028183cfc28335dd8d3ccb24f0653c0844acf67deb18f8b529dfa83ecb2af34dc1129662dbdf20c0bba06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000047

Filesize
19KB

MD5
22d0c9fb783be9872e403b59abda6c4f

SHA1
1664f7acfda8dd86abed2ee3065b8fe2031d07c4

SHA256
0e9d548fbd6eb9d25921d5e8a2aa9fc728a099d17f65c9852bd6883dd5faa668

SHA512
5f6df4c1b662234013e1357b8fb8e19dfc23fb823f497250d7eaa1ae0c969a2bd143174a4c913b89d1ca100ae8e0e757ecde7bd60b2ce65411daba8d4d1a1d31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\335e69ddec2b9ac6_0

Filesize
212B

MD5
3939cc6b3d97b62bcdd491f0a9e67e63

SHA1
97ea2c9815c98a3923840064f2a7f985239e9346

SHA256
46a3b420b604126b208edef3753c619ba3d0783f97ff59a1585f6bf0326374a7

SHA512
5f354f812c10a64850bb0acdf26b2eaa1768b200f7e8ced6343adcf82ac0d709a3ce448a4548409dee8f105475c75c9b35d71dd53cb148a48ff64d1bd5398794

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
061a43229effcec5c8305c86bd343bc6

SHA1
f9e6703d508fcecb933c85772daf657aed9ef7ad

SHA256
a15c04e1a0fcb643fd888e4955505819a51e3e485a94fc85cac2c3cbd975273c

SHA512
897739b3c4ae9ccfc66161d6bb09f81f471bd4ec9d26ff2390256ff7145657e2eab088dc68dd03e6f6e6cfe0ea2834acfc4162f1ea704b2a7c263a4acf238136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
59985edf48ff5c8207d7cb0fa2733290

SHA1
4d3f077f5b7bd18e39eb5373d3d1b6aa62bd4ca1

SHA256
b71196fb4e2ea8d3ace4398ce676480283051fb416e4d38cb1a91375b07af9f4

SHA512
a4100aa6fa7fb111d5b28c718b8ff46cf58f79e675b8121770c379137362a47c6a93f6088b729752f633dbcc8a40c8ea5adf3200a0b669339de8d41494b131a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e40f5bb417001a88564b96074745d362

SHA1
3ac2201ddf44fc3d14f6e0b50f8ddfc7890be13e

SHA256
70b754d5112f6d7741563e87bcba13bed4a0868df9dab7cffe1c227d9d5624ad

SHA512
3922aa557244bdf7e6cc8d2c6c372884df73475d6c687681164a12b6be693df14f9421c1540ba51ebe42fb845626644369e606b76052555e131295015f3e95aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b694ec1b4678a1a440855b45bc098bad

SHA1
0ed2b1179f3a19c3ced2517a9e901227039e2dbd

SHA256
7a67b2fc803ecebd3b5d3d9c3de67adf9f3b0749a9892454aea9efb77f57f34e

SHA512
15207bbf71b194b4e9aafbd92d9be932e3f8c9f8e12ad9caf6bf573641910c988fe7813ac57bbeb2a9a035031f514ce6098dbd1a6481a58954a354dae379ecc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f52320b9515299058ec17ea1eaf20dc1

SHA1
34ecdcdd81b5466f003ffb31f6ceb9604f760b8e

SHA256
a1eff221572be71d67c0173157a454fdcf1b26109d1894e9e8727359392a2a2b

SHA512
0b8cd07837c198d4179cb77c7376a891aa1c2761056eb5d6cb780b81d2e9e0d0b728c53807596e541e4f3fcaebf00c89508b72319d78a3f02676f3eafa9aeb33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4334cece605c0c47d6558652ea48cfe

SHA1
796b459a5e572cbec9070ee56bb6e33dd0d5aa4e

SHA256
3ac050e36d660c2a353546960b204cfd63f4af3b6bf9b6b69f4c625c66558518

SHA512
c6b643c65270305a2df0055dc0b2b7d785fd40c2d6b53ba208daaf40f3785d3ad0ab5bdb503bf3f8a90b850f649dd310a96c7fbbc85abd9b8e85ca1977ecd2ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d29afbb8e6fec9d080aa8c0d533aa87c

SHA1
7ed7f9eff69971a04e1796b5eeb049530f590af1

SHA256
1649f899d77fe8804b6da9d264e690bbfaec2576ed7c238c81e3f5b6442a76a3

SHA512
d75e7ea68edafd77f444f2d8553cf38083357b8c7bb7527a04a0a4209a53085a76bfae7191e6cb7807c4500271d1eb16ccf44b418631333d8d70bcd8b81a2ad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
125f847a9f1d55c68269cdb5573f89d9

SHA1
26bf1d4dbc0b8d25e49ef7d17b41e24a5ce1c5b7

SHA256
45ed3ccad0df0190b9058ef95545dfa23bd7c49f3be8d1cc7d6aa56a350ec3ac

SHA512
6905f4191d41c08302ce67e92dcc5ebd24c52549663cb851b1182c5130df3f76cd271f73878278ed826a78c5e2659071e16266e8b03a02f7932f23b8245b1005

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
84b343e28b739ac8c3c753f042f88964

SHA1
340569e8d30253016b42472f52bd958d0ef1a540

SHA256
c78a4765f7ef213cfbe4fe291b99d594589f8d977aed3e2dc7a98cee0ce6ec80

SHA512
782d90d4b9a6a0f6560ed82c2c851134109d532998603b8269670495a2bd40dc79f043eaf43d1b3a8931cf59eee2966fccf183cefc8f0c594c16bb89e3cb682d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580ad8.TMP

Filesize
1KB

MD5
3db71881dd727a48841351f5c036d939

SHA1
716b2575bc4c798148cdde935c4b24f0f8918f99

SHA256
0e5d15c81116306453aaab422ef78aa1d188b1e9f1d641beebc81c61e6b52b39

SHA512
8bdb7e43695b6bf27d7f9930c0d54571597de2a5b24d7c6267f6213b1cbcf3499116d0fa722ae99cc20d1bff7c68698fe76b7c31f19731f70435f97994c5126b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
205c5608bf9fb3e7bed5389773eed31e

SHA1
8db4b9a1b1ccedecb132eb5f043174a3354cd6af

SHA256
ef232ec70e20718fb0929c38787c215969b6fdaa6220d825d3564caf99471b40

SHA512
6543a809b3c5405be603ba9760930c3d61a9ae6227eb67d1cfd98c576db2c3d1f04fa22ed9f86f4b9a01afde2b2c95fa0ff200d3a8778a26fac49ddef4f89ffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
798b3eafbfb2812ae27f4366d1790934

SHA1
4b27b35f9a2f17a1e6349525fbecf4fe72c09c1d

SHA256
c7dd2b0e1432d0d055645f900777b013abd8d7b0d9cb194b65df68ad5bd5bb35

SHA512
473ddd3812750d092b513043a691283f6d2d926b9a93a6e2e27798d81a491ef613cf902509ab533676e02768a9b5c7390c484151d22faf7b5a37628a094a0533

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5c1d2f1ea8690a5008562f8c05fab07f

SHA1
37faad896d52b95094b77b13bcb5d20f6fb6886f

SHA256
3cef17467835651691383e52b34dfdfe3e114f857e153670a7aa11d1b4439d45

SHA512
fe1a5eae9d45c4e4442cfa8228e15e3773c455179f00d56b667125a42b5550ab1efa8ff804f2b5dcdad84a2313afc6e987cd04a7a58cc491ee8642385a60f1d7

Download Submit