hxxps://qltuh[.]stonebeard[.]top

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/02/2024, 07:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://qltuh.stonebeard.top

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-635608581-3370340891-292606865-1000\{F3D95A7B-3F3A-4AD4-B228-CE638FEEEB56}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4948	msedge.exe
4948	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
488	msedge.exe
488	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe
948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1104	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1104	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4948 wrote to memory of 2840	4948	msedge.exe	77
PID 4948 wrote to memory of 2840	4948	msedge.exe	77
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 1848	4948	msedge.exe	85
PID 4948 wrote to memory of 4752	4948	msedge.exe	86
PID 4948 wrote to memory of 4752	4948	msedge.exe	86
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87
PID 4948 wrote to memory of 1636	4948	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://qltuh.stonebeard.top
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa67aa46f8,0x7ffa67aa4708,0x7ffa67aa4718
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:3148
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4532 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,5415071476197906974,11336731749460860936,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:2700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x418 0x41c
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fa070c9c9ab8d902ee4f3342d217275f

SHA1
ac69818312a7eba53586295c5b04eefeb5c73903

SHA256
245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7

SHA512
df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
69KB

MD5
a127a49f49671771565e01d883a5e4fa

SHA1
09ec098e238b34c09406628c6bee1b81472fc003

SHA256
3f208f049ffaf4a7ed808bf0ff759ce7986c177f476b380d0076fd1f5482fca6

SHA512
61b54222e54e7ab8743a2d6ca3c36768a7b2cf22d5689a3309dee9974b1f804533720ea9de2d3beab44853d565a94f1bc0e60b9382997abcf03945219f98d734

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
29KB

MD5
df217f862f4073ce4585999df73a53fd

SHA1
8f39eb965e90eee20c2e94f547acf0db9aec24ae

SHA256
dfc2a82c870fd4c1a5b67929c316aebf1bfe0e8fdb90d64158a111feeae9c0e3

SHA512
f52da493abb8eeae24642e958cfa6ecf50101cdb0038ca7b952a19f0df0531e44828e4d2b9e365fd08a73a3f78009fd76af37a1ae58b8ec526720356c2767738

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
1.1MB

MD5
eeb2da3dfe4dbfa17c25b4eb9319f982

SHA1
30a738a3f477b3655645873a98838424fabc8e21

SHA256
fbfee0384218b2d1ec02a67a3406c0f02194d5ce42471945fbaed8d03eaf13f3

SHA512
d014c72b432231b5253947d78b280c50eac93ab89a616db2e25ead807cab79d4cb88ffe49a2337efb9624f98e0d63b4834ab96f0d940654fc000868a845084fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
81de39107b53e69246d16d40b19352b2

SHA1
eba37eb4520efd7f5bb2f6ee0a0872b3375730d8

SHA256
a586b042fe0746608877748c0ee33dfa506a57f29a8ee6f9c455cee1d04db103

SHA512
51bf44c6f6fb1cc0572d5557a2abeaea55723f96caf8a375b120fecbc662abc71a1427ae37fbd342f77c8781c3b9e819833347dee759852c8650c9dff46a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
f5a24d9b27677208266f7b49ba10816a

SHA1
3cd660439fc6c2d9fde11c6a54dd9f25665bbcc1

SHA256
b958bb43b01baa3f5c1b3ca842dd9916226e5a91bcf09fb235569b5b2c0903f0

SHA512
ad62eff495a880a7997336cebf85771febd95299429152dc75e34322eee84ba5304545fe20f7f8ff5c077e90940992104b7506daf5c757b19e56ff104481d7d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4c2022014ad1225eb40a1dad89abbf83

SHA1
83b77746de9d646b7fd8d1d73bb41f58fb469a44

SHA256
b1ecea3cd82526193dcb61ad2743bc7fe6dd90a2e5dc199a211401f949721e89

SHA512
9efada0854a2c99086dc3b8d7b99a83472831946cf92e5884b100c6a8b5e1cd4aeb86a8989a32073703a97fa06ec2e8e5d8b6fa43f99c15f781685f52011702e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
976B

MD5
d19663267d0423bc3f8bffb31177352c

SHA1
4d3e290734ab49decb1879b83e93b9b180708018

SHA256
b0f0ba31a91592148d24b202399ad3105ab808a07a060efa44ac67518b346865

SHA512
c32564d5fccd566ee8dd247fb07478405780ba5c23776f7c7513cba92f61208fb24a6f51445f813530d3f82e4f40e6de238ba331ce14bad96e241898c292cfe3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
10f34f9c47f8865681d8036e82452bb2

SHA1
694ffaacf5b6ada4488dd7d20d2fd5ab83dd94c6

SHA256
f1669d6f5fc7b06c0d298aa1195e41320250557ad629f267a14808c305809f11

SHA512
3e1292302f17fb1cc55ee1ba688f118ccaf255ca27a88d5a6595a045ad46ce24a6a1ea0f5b6353f9a9bf74995e705ca622032f5034c171c2f2496b645db7340f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3bb1c46d2a3086e4c113aff1cae2f9ea

SHA1
8694147141a1c9d1c3aee0a6c6a3137d7fd57619

SHA256
ca2ac687a9cc8cc0cc1fd721b889bcba95ab70aa5c416b84a3ec1fb8d4b17ec2

SHA512
3f6ebf8bbb3c8dcf2aeb638c0747ac1a483247f45a989428ab342d546068e5116824d7159141998f3e8c28435a8b58ea18a0e7e4c31d18188a57aa73ea9e9276

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1c8cedbea8a45b723d536aa93644017f

SHA1
eb69a1602dc53ced5a5041c007ac81b38908f6b6

SHA256
9b3838ffb2544661ae2428543e9a1ce469bdcd4634e75dbe75dfee0c0d6b70da

SHA512
9fd0dbd95ced991cc76fc41236621a351d0f6a5e493c7b5b952cde863c7b46a0b28565eb0e656813f9de32a3807518c6c94114eebe958d0b257e8cc38c40b89a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
917dedf44ae3675e549e7b7ffc2c8ccd

SHA1
b7604eb16f0366e698943afbcf0c070d197271c0

SHA256
9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37

SHA512
9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
9b18e60187afc2aed4a1beb048fa129c

SHA1
cc002b6373518d76134963ce927aaed9109f2ce3

SHA256
030c84a7935124f455aa81908255fdd47eab22452ec6ec601cbeb7e116c012f4

SHA512
4ebb90943aa817d068a50f4b50bb1a6bf3732408da167b925b4f3e57086114eb28a1fe5a30654fa04bdeac911756a36b1378fc94081bb44b1a148c5479e7f91c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58047f.TMP

Filesize
705B

MD5
87714757d98dbc0c07d53b93a6d52a24

SHA1
04609655c522e349ccb922417cfc15ea94c1ea71

SHA256
a44b0d4a6482a7d93b4630b8ceedcea24855d7b944cae380f022bb566e8c0c81

SHA512
5e1793e64b99dba4086082ca325b6c7663d5b82141b07b368b9c9a9419c5b2c00803e4b6a55b85b8e68f7bdbe99724835564f2698b1f46a0a044d765d32a59de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
29167def9d5a156b6fdc2c011686f9af

SHA1
35577226bc2df1776026f6de6d257dec2e5a4f8e

SHA256
e5663fcc0987cd4386533198a4edc943f2183d6cdafbabe8a6f5a79cf13da64d

SHA512
7c4487df1a23bf9df2db0c5c033fb88705e13033f674c9d9022fa950dcb76cdf8f2ac942afc1b93e6b934b69a1d58ed06121908113b25d90c2da23f9e6d43ac9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cdec381bd26f0db0ddaaea981d4ab501

SHA1
400a116976434c26999a8caf33eb54156efb0f66

SHA256
55e75509eee580daeb52465bd87bd9ec7f732481039c76373c84bb7bfede019e

SHA512
b90d24f0195cb7b89146908f0b172f2ed6a0e1f980c45ab08c15419b6481ea64979bc8029407789f9ffa24b106140cd44479af801a4aa5570b806a5c208cddf9

Download Submit