hxxps://www[.]yumpu[.]com/en/document/view/66006473/download-pdf-fleabag-the-special-edition-tcg

Analysis

max time kernel
61s
max time network
66s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12-03-2024 17:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.yumpu.com/en/document/view/66006473/download-pdf-fleabag-the-special-edition-tcg

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
3144	msedge.exe
3144	msedge.exe
1160	identity_helper.exe
1160	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 19 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 3596	3144	msedge.exe	88
PID 3144 wrote to memory of 3596	3144	msedge.exe	88
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 2036	3144	msedge.exe	89
PID 3144 wrote to memory of 4316	3144	msedge.exe	90
PID 3144 wrote to memory of 4316	3144	msedge.exe	90
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91
PID 3144 wrote to memory of 4480	3144	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.yumpu.com/en/document/view/66006473/download-pdf-fleabag-the-special-edition-tcg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad5df46f8,0x7ffad5df4708,0x7ffad5df4718
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:5504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6764 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6924 /prefetch:1
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6600 /prefetch:1
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6592 /prefetch:1
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7216 /prefetch:1
  2⤵
  PID:6192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,10493660478507214007,16236539926429088845,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2176 /prefetch:1
  2⤵
  PID:6456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1544

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e494d16e4b331d7fc483b3ae3b2e0973

SHA1
d13ca61b6404902b716f7b02f0070dec7f36edbf

SHA256
a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165

SHA512
016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0764f5481d3c05f5d391a36463484b49

SHA1
2c96194f04e768ac9d7134bc242808e4d8aeb149

SHA256
cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3

SHA512
a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
3b640275cf5b602b9069a50b9286597a

SHA1
0a4529cd90bee9f2fb8f0be0b8bd7d9c34fb9ff1

SHA256
85a0657a467be4cb7a444f33ffc774e59c9b9455bceabfb613bb4878b3e820d9

SHA512
a85253f012b92823a86a2b2bcd7d86de0acd934fb5fe80cff25f3ad0614d6d56f198edd7a2409c809a53dd48b31db22d8fc5f54a7b2721ef4f5a945682f09865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2759ace0ebbb012079da11e4feaf59dd

SHA1
997e081fafe63242c4ea96770141c8c982af7636

SHA256
55831192d08e0db97fec0716e73363b2c0dd6c6a6a6a4a9e413e778b6c8405c6

SHA512
f14af48085e7bf57a610ad701905f5819cfd25116bdd913b17673983c8bed5f5b92a1a86a304514749ff57939bfceb32adeed35e510ae74f6b38c39d60bd15bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
50a30165e408211959be7cf59b0df415

SHA1
d3199c63004269f278b7f6e429ce06de99b8de8a

SHA256
e8fee552c0b0120b7c9edca0f9f69fee412eb121905f86b65ab2e05dc398e554

SHA512
cdbe316d135532dcdd93c98ea39ed7d8be3d8092254c8d675532b26addf48d3372de18bffa1b691ceef7618bd89a18a3bc5c77576909aab4cc45749b87fc4248

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3aa3966d6bd89dee857992d2b9fb6a14

SHA1
d6fe8300f8b4862249116bdcc4aaa955e07d9656

SHA256
4e3d34eff710a8ed1314ff9ca3f980c3b4c51fc13b2f010069dfb2592260157d

SHA512
eaac553defcfa20a45870e19f21195c0159ed520eb92fa137cecddefcd73138c6005c43e27276da82f5e8e94e106b5abed5f4288396ba21c48a765eba66d70f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
11KB

MD5
5e5d7e1243bb71181cb91fc3ff56e09b

SHA1
95e85c8fad7c65ce631c7279c957687099a811ba

SHA256
21b2361b2e7569a7b6f8154c751400fd7ddc41354f9f8a3f591031ac35858b8e

SHA512
3e50665044a495b9156b43da61fc1a74378319489a24a9694ac95b33d3e128827ec3fc88d1c84269a862ff835a228e8a4037a6e38b78a1751758d37b7920ef73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
27e3948a1e40f26ac22d10d1745ea79b

SHA1
a64cb98bb5175387d30f8f9cd348bdac39a35cf3

SHA256
20390a6bdd217d393ff97678c19098f562cece8c16cf9675eff70e2d8bc3842b

SHA512
93227738e1ea8947845cf957fbf1f26603dc7eb68ff185ec1c35f3236c9daa476b15f206066cdce3e4e4c6de0ed109f02ae9316cf088c5e810fb9c1bb212c8c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
34fa90bb0b766f4c0e656b00dcbdf9b4

SHA1
796265203fd11fcc5c255725934a2561e29d270a

SHA256
1418780b74bb9b6d4437af09744ad98cf2ecf46c81c5ca08d75c3b50c6b3c8fe

SHA512
abf79b80567222e3fae59c9176e8b80082c1810692f2b15f7089281efbcaada6264c8c50bc151e688aad987d0c6b260b462b8f8811ed9c06d5409cd41dadf6f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e550f5caa6f5d0779f4b2c331694c73f

SHA1
1ceb763dfc4b0bb638e66ca1d968e2ce7f9f2414

SHA256
73e08f42b3bd74f15fe8989c3db652536c636b39803de66183cf4ec37313cf49

SHA512
59b2e575a6dc95bec0ee3ea810ddf13e45f6e205431a0fd5b46e94fe1741ca260e75ee83c31f991c916ca0a00fdee509a30b46708f41bd4647e0ff44e009fed0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b8ff.TMP

Filesize
1KB

MD5
525192e309bd15c2bc41e3770dc94dba

SHA1
d37a554b21ec6a19615bedb35898bad209aa08c8

SHA256
d8932c9563af17dcdc77234b7bf24f85c1351c99ba2ef9e68c89e37f457e18c4

SHA512
0abec742407c018b3400eb553b63022b570f75546bd99178945a9e195f8f047aacba18f029074ec50e9e8cbb03e10a696909f9ba8bdd08578216f1449eff36ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1939c8ff8d396cab8f771fc3ef7f2041

SHA1
254525af54cd2813a195f4b34156c189128aa1b2

SHA256
c2545ef3815eb569b6f843bbe182bd20d6ca63c4b30b26c5bfec73de8391f4d1

SHA512
8e347731d60d9336fb3ae2b9003cea4c67b624a3f794fe55777b0a177056610f09094d47e2ef48ec19212211f86db3575dead6506799547ee6a0e03cb602c818

Download Submit