hxxp://rap[.]cega[.]online/

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 07:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://rap.cega.online/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1080	msedge.exe
1080	msedge.exe
2776	msedge.exe
2776	msedge.exe
2388	identity_helper.exe
2388	identity_helper.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe
5188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe
2776	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 4672	2776	msedge.exe	82
PID 2776 wrote to memory of 4672	2776	msedge.exe	82
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 5056	2776	msedge.exe	83
PID 2776 wrote to memory of 1080	2776	msedge.exe	84
PID 2776 wrote to memory of 1080	2776	msedge.exe	84
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85
PID 2776 wrote to memory of 2452	2776	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://rap.cega.online/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd50aa46f8,0x7ffd50aa4708,0x7ffd50aa4718
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3940 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6788 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7036 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6560 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,17328966376466738797,11635004380118651879,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6316 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2256

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x48c 0x300
1⤵
PID:1452

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
846ce533b9e20979bf1857f1afb61925

SHA1
4c6726618d10805940dba5e6cf849448b552bf68

SHA256
b81574d678f49d36d874dc062a1291092ab94164b92f7e30d42d9c61cc0e77c3

SHA512
8fb228fae89f063159dabc93871db205d836bdb4ec8f54a2f642bd0b1ac531eea0c21234a8ca75a0ae9a008d2399a9bf20a481f5d6a6eab53a533cd03aeaaa2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
104aab1e178489256a1425b28119ec93

SHA1
0bcf8ad28df672c618cb832ba8de8f85bd858a6c

SHA256
b92c19f079ef5948cb58654ce76f582a480a82cddc5083764ed7f1eac27b8d01

SHA512
b4f930f87eb86497672f32eb7cc77548d8afb09ad9fdba0508f368d5710e3a75c44b1fd9f96c98c2f0bd08deb4afde28330b11cf23e456c92cc509d28677d2cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
19KB

MD5
a0461eb6e007528ea8b7323df5c141ce

SHA1
dab62c0d8c6008c37cc53a4bb9c443f045627e45

SHA256
6164562b9a07a0905239e44743e39aaaa0550f8471ff8f9622dcc68adc35f920

SHA512
c009e132bb97eb4f964174aa196263959c6ca251eaa44a808c2e084b9566628a16f65f47f4e2ab1222c5231cd0054b88bec954bf0ebd8cca35112bff73ae5e8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0db1ecf60c5ea298088bdd7732a499ae

SHA1
93f7533d4a42b9d9866a2e293ed725e576dbfcf5

SHA256
412846a70d1828a6e4447a0cff27e88f955900784c97ec2bf0022cbcc57068cc

SHA512
10f59a7ee41d0f63bead57778974191d7fa6c5e00a6272f29e50af3b3cbc27fc2b11215c734cc80d28a44ee509baca57c38a9406b30cfb3228828cd1e19aafa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
0bc3fd9dd286f96660ed764c7a6e3511

SHA1
c674cb8c33ae1442630b24520857bb8ba2aa14f1

SHA256
a437ed9ec28a8e6380462dc15372683e677e3c209de5c1391568e1faffa9a03d

SHA512
f7bfd2b6eb71a67c2c043d4a8f28055eadcb8e4204c25ecf8fcca0b2e0b402e5bc5736082bdae47cd3016f26f33d39d93f7c7324b9322ce0e959234572e672fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f345438c7a99d852067e5a1b8e55ebf

SHA1
dc2fec1e3c9ff15c4e86ee97c480488318bd3d4f

SHA256
3f9ebd74e264a38531db10e962b4ab89e26384e24dfef0a0ef51cbc11eb6c07e

SHA512
9e69419ff516736fac93fec4d9e0cc595b7fdb680f4182b6f0eaa3bf0b43e5a88b8331fd97ad4a8169b52ae3d249d1c795cf5e349d19e4170dc8d724ea3f152c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
707f38d8ec6113893d4b11b610578dd9

SHA1
7a44abcdc4ba2e3e5e9ee7ff6d629aca43c6d47b

SHA256
6bd848368424f8d93d3d158e61950a55be2ef7b773b3740fd6092756947367ce

SHA512
67fb35a485850e3e7a04a47d821e079b47d2a4fe5c2d23ca354b2a2f8b5a8ffc5af4174bbb375e2843f34769c62373894d034a9fbf324bc5718504cb08d50f9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
368d8f04e001f89ce42d96733d141e37

SHA1
9d667b01cc39ef90545d120542a839c2be450d1d

SHA256
b41033a0df65066a862e68ff7f052e7aae659ec0b7df6c5ea244065a75e697d0

SHA512
e5abc3a71cf455f0a9c07371abe980eb88195815a7fedeaa377f90d7ea292c7efa1041eefa47f6f780ed81d767acb2dc162e71cce24f04a4431a65f846ae604c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
12c1590faa9b824bf5c368b09d70a8d6

SHA1
f7446dc3683e18d8b6b25cc668050aca7c72cdc7

SHA256
ddc27d0b7703e9774e5cfc006ef4912e97add7c933e87a979f7ff45ecc5fe451

SHA512
9458cf7e9a9cbe24cfd352a6668ab2d118823f8f8536fc0ca956a248770fcef3463c530016e492a351dd03e69c15d832cce8c8c1765da85aa52d5607a190ef34

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9387ecde32dcc9eedc443790b70db25f

SHA1
fd16370c223f7e7b8c92a9a04cc070aa39fdb30c

SHA256
27a450e78a03ecbe8748d0e3606e49b31bb6469981aafabd602b228ceb257f3e

SHA512
ecdca561314e99c003d165119ba97dc2fe9eb28f0f66e1da771944976d6d297582a4f5b7226a51970b93889fca834b5eec255c57fca1adec5f296bc4b50738af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dcd84764c6e718b70cc945e827d79881

SHA1
f63f6d90eab40396c1188f06d074a6d951d5e0b5

SHA256
614c05e6f03875e0becf3d327ffa74987b1141f5782fe66d9ecb017b03858e18

SHA512
c2b375d51e1fcb5560ae233dcd06204bd7a9f874ab54a3ffe9100474efb36acf8aa6e667d15c61ededcd38dd2edd41d54a290c94f4f79f4a3bed4129e09b5eac

Download Submit