hxxps://sfd91891589061004[.]whataform[.]com/

Analysis

max time kernel
960s
max time network
964s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
03-05-2024 19:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://sfd91891589061004.whataform.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2908	msedge.exe
2908	msedge.exe
2684	msedge.exe
2684	msedge.exe
4976	identity_helper.exe
4976	identity_helper.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe
4924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe
2684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2684 wrote to memory of 2872	2684	msedge.exe	84
PID 2684 wrote to memory of 2872	2684	msedge.exe	84
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 3956	2684	msedge.exe	85
PID 2684 wrote to memory of 2908	2684	msedge.exe	86
PID 2684 wrote to memory of 2908	2684	msedge.exe	86
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87
PID 2684 wrote to memory of 4020	2684	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://sfd91891589061004.whataform.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae43346f8,0x7ffae4334708,0x7ffae4334718
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,8911113020136038317,11608159312432843557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
45KB

MD5
30a274cd01b6eeb0b082c918b0697f1e

SHA1
393311bde26b99a4ad935fa55bad1dce7994388b

SHA256
88df0b5a7bc397dbc13a26bb8b3742cc62cd1c9b0dded57da7832416d6f52f42

SHA512
c02c5894dfb5fbf47db7e9eda5e0843c02e667b32e6c6844262dd5ded92dd95cc72830a336450781167bd21fbfad35d8e74943c2817baac1e4ca34eaad317777

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
21KB

MD5
c2a1ea15a077094bd59bae121e98391c

SHA1
108a11441b53adb236bd8cfcda3ef0b560b29434

SHA256
e7195384cb7e221f30087b345941928b27d40e9ed494e7f5b44347f76644f05e

SHA512
01fd6549c10c45abc29442df4d18f6ba49ef53c6aabc36cd1782a3d74fed0ec7ac1e6f34ecfa5b9ce619ed6b49b024e1bdd3279347acd2dc9cce65f079dbe198

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
110KB

MD5
6f80ad5d25a6aaf8797233dd68002d48

SHA1
7015329341d50ce9167072ff00f9f8c05f86a653

SHA256
db5f55d319a8ed4dd04c239b0f3c8108c7efac165cff288dc45bb9f7029a0ea8

SHA512
933c16f257f8295e0eea559ca0c5a9ee6963a3a837bf7ef13250f8f8b1aed4ab90126ca75ddd759e686a2dafd04ad7597346a01db2235f2b30cd0d737e009fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
121KB

MD5
047ae61166cbfc7c6eb6ad81c3d82fce

SHA1
68864cac82d1fc04343757ed622c7c9b89673425

SHA256
12c021214c27ae06f674e4dce0904c279619c727acb1e8f43d6c427b7a0a93b8

SHA512
f125260c5f0b3be019737befd4eb44e20823cb5c73d350da9012a64105ccdb68ed2cf470354562b1c4cd06c972c756f9de2cdfb64e1ddbcd88ab35079d54e68e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
638KB

MD5
0d2a5cf9f33a94c8e90828aac2a1787f

SHA1
31dd877c88bc76d26bbbcfe6c86c6cd76ed82ace

SHA256
c9edd46d896c2519a7d6dd607899244106bd130185e19a4d249a9da806bc71ff

SHA512
02d55cdba0f578f0529fe272810408e000dca92898e6010e5f3913eed7564694da1969573300f8ef328e14f6ccdd1fb651521abc77d8e91124b217d6bf90e031

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
3.2MB

MD5
afacaefd7a3fbc9fc5480c7225934f0f

SHA1
7cbdc6c90ef74abdb625c96b7c3c1bff320afc07

SHA256
0a221f38f14687fd6a6d05025eababba480930f41cfd9f4e876baa5feae474b2

SHA512
06f8976a80e55fc70ed6c22deef4b93bfa4ccdcde2df4a6d18e8ea685bbc47333905da84bb15903cb6c0b940be71950a136e4a91317bef7c60318a48ad14037e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
1.1MB

MD5
5e86505c6ae6336db6bdc413fcc2dc73

SHA1
27d0a9d115074fdc9e73a0ac43f1037b41f73e7c

SHA256
2e321bfcaffc7ba8bc8cd5555353dcac402665ae7aa8bddf61b3e428e89160a5

SHA512
7bd2df609d30e36983768738e6550dd646da6899b069911c84e234a290fb211677d7c688251311bdc8b2f49a237b38231dbe14cb40c499f2a7d9e479d8351e5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
df8d7deb701f9374a39b276e473bf32b

SHA1
a57b90d32142eae4d79ab7af59f74093409c242a

SHA256
b25762074c34d6c499d2ca07b8ec5fe3db36ecdfb18528ae310578ef5d31756f

SHA512
119b41ff6e7b0632a545e6a3a7ed1ec531749a4469eb6b2a192431b74375269795244927ac22152aaee03872a3870e78a8b1d95b381bcc2e49c16e4aa2013cda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
5a615c3ad66e8e3dc47b44877d4afcf3

SHA1
24aeea5eeaf2c593576f510636001952974db6e5

SHA256
91af278668d5a833184c53f0a5da6710d2cf2e882d15dd04fb425f5bb8e81ccb

SHA512
7e555b508bb01af92929c3924a237bd85e24885704bf86d95abb783ba50e6470c88468e60e7c2788b05732263549836a97e445f92a4ba138ae59c148306a95da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
546a61da6b5fa40480ec343a699ca313

SHA1
6c586c1a2f68dc38e3c172388d8a373820020af3

SHA256
94a0628a1dce843cf04a51ec85d656739d0b1dc0e8cc26ba4e96f2037b60936c

SHA512
e4000f5ab8d75335a60e421f86a730b29aa8aa5979e7ed979ebd55a0c0ee01c01a6f58540fc1f36954f7a0e12fa55a60730330a089c0414f803e06db7f02013d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
c4c5630560b163ba04c4722601b27b31

SHA1
c9a45f93ff16f9da67bb63f765a9fc19d5b65380

SHA256
a8615913a436d83f91029bcc6ad579cbb735c4f5f27c5fe75af7d29ff4992be3

SHA512
6a05077d6c7c401d386f38a529d0f2ea6cec379c1f144cf7856d0efc6fbcae3758f9040dc7e9f0ff1b229bc2e82f9e19b3456df8f6dba42eef55cd090a388064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
fca9036453327362596748ca55df6eda

SHA1
31e33764032c4a8d65f156bd07b09f321a1bd48a

SHA256
6e85a8057167c84d88e345ff47dfe7e929765d4d9d461f4e7f157c20cd2eaa40

SHA512
249873a1ca305752b0ad46e72516c68cbdda25126071ef62defa310464dc770e82c042b09600a8d1d3bc5b4ea9fd46457938764563fa3e1ae484f7b4e23561bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dd9c3b9c58fd6ff77a406af804fc7170

SHA1
3616988d722f93c0f8ce4fe9d4d199fa4a1107ac

SHA256
c71b487d6362d3cfe67846718ab2ecf91d6035476c8773492c1550be81602771

SHA512
4b5fcbd5a63cd0f3cdf60576428b4e850541af775f468daed19e476bd6fc5944596671cdbb706c790ae2a337e0af30db70848aef63fcb3b28e72cacffc34b0d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c95180f1d6843503203e1ceb136874c1

SHA1
bab5d22b927ad7ec923cd7988c8e54c8602f6433

SHA256
f602c170b1840621effab83b752a8282c16e6673576c0a75347f967210e9d275

SHA512
48d6b247c8830f21dee3a6ab8da3e82240a00ff36a6a906f523baf412c17a682d07a20a1078eacf77c6368bf323c976f957fbfa3322ed470c5cf6ef2e1c79e09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f5adc65c9c8e78022bdbcc193a3b883a

SHA1
df0283ec3494f2b12577b4e47f3bedd268ed7a80

SHA256
8e2132eba65dd0900b28516fabb741021ccc37a687af84579601e7252154a458

SHA512
38fcb6047e49961f44ae5bfc269a8f54ed25a3e78f2536b5a1a1cc18d50b81c74d3cc0490431fa96c0bf11cfbe74791a51180c0ed3ad37af681366f16ee09a83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4f32cf69d3691a5acfc7eff0216cb3b4

SHA1
2a87dd6a85c1f5b70c63380721fa104783b34a73

SHA256
f3019a5700b763d283d4b2ed19c278447cb90de88a0d371ad98be07a302ae3fd

SHA512
cbf58390f988e94a56db96c0180540172f7655675f008ec7f68e1fbb03c83349013c156e6b56c8912dc768b6bcc5006dae2a3a2c67644421c08699126d3b8615

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a9db6e178dae2a7b406639865da2ec8b

SHA1
cb58d5c25efd3b99d9c51853d2da092edfda6614

SHA256
2cdd2c4626f195f8c9b5d9517078733a7cfa1500a1aebd484ee842995342c910

SHA512
81b4902e19174392ad3550a083079f47610b972dee7600b791251a0a4be897c113e33e75be68854699cb3eb796550769e909a60e660708530f489d0aba387aff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2be7226b6b7ded7fed36211f291d97b0

SHA1
e1be26fcdb7581ac9dd3491bc645760d11e16744

SHA256
4398c548c7609e97ffb0e5cf3883334ba943ff88dee3da1f21253f1f3649bb4a

SHA512
e847c672906cd9e29464fefcd1c0ce4aa83f56259697a8f531eab1aba40a3cf9792cf81965cf8546f122d404e6b432d8d37decaeeaeea8c5e8cb032c9c9da3cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a1b8a443fb6bb1c52dd29dbf13f70757

SHA1
a2e7fd39141a2f0998574eb5f6474c516e942f31

SHA256
2f93c2e8fefece0bb91dc72359c4e26a308f6d00d43f8f18a52517f4548418b0

SHA512
ae43338fbcedf3c3b59db791c2d72a67d3da998f6d543a0f5912e477c45b6ee917783e740625702ed3549b8cc375b601255176802392ae654c28af9bb6cc824b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1a302af7e70ed95ed1aecd86d3e43f4e

SHA1
7ed0b7a6fe38d8787d6979bc3802700111156792

SHA256
a9d7fbb3da03b841406c16ec178700b69c0fb45a1accbb80887315e0ddb08a6a

SHA512
95c5486d1e4690db909dc7ecd0f8b696f30898ccb43620883f65a4fd43ff5e92b65b6f8aa04705463ed01757af3347a74e8f08d9e3c796d490dc7917dadcf9b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91b5b9d1c68c79791795a63567237934

SHA1
9be3a1ace649a7c42744f82878d239a6224969ce

SHA256
2ef09a6c883079325c4049767dbaa11d57bc334e73f4aa2eea498633051531a6

SHA512
38f414a8df0fbe91c9e05ce42369f561d14af7ba36ff86252aa911c1ba286ec8cefe7fc539ccd5e630938e2d3373b3b6316e1615aed16d41ecfc6c1a37977a03

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c40fbd9439ec89c8cecfc14f9d3a57a5

SHA1
6f1018481825c2612ae5124591b0c3ebbacdf64a

SHA256
2844158048800c9b4dce22833226768be6ab1e819365b628715a3cb2e03a33c2

SHA512
7cd8d1f65b9f7710a16ec0c5352731283aa82ab2f0320a2c7ef60ce9e1300dd53c0d3e297f9922f37fa11f995a9e848b74643ff1f80c2f6acca10ad70369dbb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0a0883c8260aabec924925ca2bb88319

SHA1
f741595e2fea2b76368923e9019f67061dbec534

SHA256
9fa5ea640df707d9d64c8d833ead33a461205cef214cf2b18936caba81fb0fc9

SHA512
c39cf64669fd52936eb63c1a8279ea504ca8ffc102d6788c36f1581c21b682561a72c337d8ceb23d599ec0683f02f47430cdab8d70fcc5759b0a3452099fdd91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
25d37f079e016c2aecfb0ed60021d1c3

SHA1
1ca96bdf20df418b4ffdc9e1a49af8580c64c76f

SHA256
0c61d57c38c05a43f894242b259234f1438b9541d8e08a8f05deed3568158b5a

SHA512
40876f0f3e4c04946dc728b5214fcf69bd73cce69a766793070d7e7ed77318a2c52264dbb2aa708c9c84989bc641ed7b7979a0eabd014b9b09f8e72e004bd852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c2cae1dad8e2d4204b62efc3c4a7a6ec

SHA1
14507a114d8ca3a2daf704520be5e8b04fa0859d

SHA256
5d40d5e0c1ea8df890a96c3ff8423e63cad9abe3506cd92184d16a9785345682

SHA512
90f986378083c4f5f60a6cbb1dff576aab4cd1fc8a5f196d370b0772e2fc6421dcc24e45be8302e4c89109cc023fa6dc0f50b6a0860c663c0934bf541696c08b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
78f948488ce72f24003e6b7116d711d1

SHA1
3a8ea9e49f4b3951decf767a5fc52fdcbd13ddc4

SHA256
8c6697709be791bfd506fde07e28ab773e0ddf850c4c783bac1ee5508fdb647f

SHA512
49e56139aefcb0ceb04184593e253ac81fc117bc9a97d124774187f0b1c58fedcef64195182db1f5ffbed51f63879e7b45333a96a00da06f823e7323e32d37c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
b96703f9d0b5389145f170e1701912d1

SHA1
0ca5dc69aa8864b6f741074bf8107b4015d7b3df

SHA256
e5ab33af6be06e866b5e9210dc167002da69e3cff839aaf862ab7d9325ebb5c7

SHA512
a43e7b0717750576f40a8ec96942f63c20802ac3bba28690ec9c91889c8076806b2f81fbfdff0b20b785475f9ba3efa8436ee5fed0590f663bc39fd5bbe5cb8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5949ff.TMP

Filesize
371B

MD5
c94519b3c9608d02ff752895df618ef5

SHA1
024796f8718ab827e0c064929863988a91625cd5

SHA256
218d10cca6245446323486aa495ebc4e0a9f5a224b34ebda8858fce2800d4aa4

SHA512
5f688ee481e5a978511a02be0a906da056b8c19cfb546cec41f4d21ec093d6915c396c5811ac17b21bcdc003e1979ed5a5dc5a2606a8296607c3212e407b271f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ed747aec7c7a88ad5ce98e40dc411824

SHA1
d05e26a4e1fc3406dd9db2a7902dab997827c3ac

SHA256
a22dd6c091edd95ffaed9da25c73efa79515016fde3ca4ccefc0d89adfade7b1

SHA512
ad65bbaa4b792f742dc1c2a98b369840bf9223a684c3efe3cc13237eea9dd78eaaaa4bc73fcb3131426d6a3a7a9495974aaf34d890096c7ea23563aaa232d002

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
bc9888a5b3fd6da761380566d95ac81e

SHA1
19a7614c8dfa5280d6d67df4d95804adaa5c6c9c

SHA256
a1b24d2d946c08202f4e4ecab5ee1ac0d8a8440bdb2f494506f004671f8b47cd

SHA512
bde6a0ebe184680d6aee8bf2baceb74ac4367a6978376b78a9638d3fe7deadaf12d127e84fabe591fda5f3dbd05544bf78fd606219515fb97674368404c15529

Download Submit