hxxps://t[.]m[.]emporiaresearch[.]com/lnk/AVQAAECkFi0AAclf5vAAAmiiRyIAAYCtaj8Ano33ACMv7gBmQnSvav6ls62sRQC7O6z0cPGniwAhACA/1/nFykbX96QK_NubXaxPc03w/aHR0cHM6Ly9hcHAuZW1wb3JpYXJlc2VhcmNoLmNvbS9zdXJ2ZXk_Y29udGFjdElkPTU0YTI4MDU0NzQ2ODY5MzMxODc3N2YyNyZwcm9qZWN0SWQ9YzJiOTRlZWJlYTY3NDM0YTk2ZTNiNzMxNDA4MWYwYTMmdGVtcGxhdGVJZD1iYXNpYw

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 02:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.m.emporiaresearch.com/lnk/AVQAAECkFi0AAclf5vAAAmiiRyIAAYCtaj8Ano33ACMv7gBmQnSvav6ls62sRQC7O6z0cPGniwAhACA/1/nFykbX96QK_NubXaxPc03w/aHR0cHM6Ly9hcHAuZW1wb3JpYXJlc2VhcmNoLmNvbS9zdXJ2ZXk_Y29udGFjdElkPTU0YTI4MDU0NzQ2ODY5MzMxODc3N2YyNyZwcm9qZWN0SWQ9YzJiOTRlZWJlYTY3NDM0YTk2ZTNiNzMxNDA4MWYwYTMmdGVtcGxhdGVJZD1iYXNpYw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe
1328	msedge.exe
1328	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 2712	1328	msedge.exe	81
PID 1328 wrote to memory of 2712	1328	msedge.exe	81
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 3528	1328	msedge.exe	83
PID 1328 wrote to memory of 4180	1328	msedge.exe	84
PID 1328 wrote to memory of 4180	1328	msedge.exe	84
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85
PID 1328 wrote to memory of 2216	1328	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.m.emporiaresearch.com/lnk/AVQAAECkFi0AAclf5vAAAmiiRyIAAYCtaj8Ano33ACMv7gBmQnSvav6ls62sRQC7O6z0cPGniwAhACA/1/nFykbX96QK_NubXaxPc03w/aHR0cHM6Ly9hcHAuZW1wb3JpYXJlc2VhcmNoLmNvbS9zdXJ2ZXk_Y29udGFjdElkPTU0YTI4MDU0NzQ2ODY5MzMxODc3N2YyNyZwcm9qZWN0SWQ9YzJiOTRlZWJlYTY3NDM0YTk2ZTNiNzMxNDA4MWYwYTMmdGVtcGxhdGVJZD1iYXNpYw
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcda8746f8,0x7ffcda874708,0x7ffcda874718
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2716 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2236,12242412929911979004,11757802535813583480,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4652

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002b

Filesize
502KB

MD5
add520996e437bff5d081315da187fbf

SHA1
2e489fe16f3712bf36df00b03a8a5af8fa8d4b42

SHA256
922b951591d52d44aa7015ebc95cab08192aa435b64f9016673ac5da1124a8b4

SHA512
2220fa232537d339784d7cd999b1f617100acdea7184073e6a64ea4e55db629f85bfa70ffda1dc2fd32bdc254f5856eeeb87d969476a2e36b5973d2f0eb86497

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
e922dae3baad50c3a0d4809c18cff047

SHA1
9173b536662455f1f6c39874dd94169d3b36552d

SHA256
8577e6be911bcced934636063f20d862616acfd23190b2ae0dd7e1bc233a733a

SHA512
e79e566c2a04a4b23d224057a9f84e357d05822064f78c8f80c8f385631794979b4f89c2937ebb908d26ae3e8e955a9e957a36a2176231645ce72f6b5283a3c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
cb58fff892c28ae7317a2d9423b584f1

SHA1
d7f351e47cdf6db97aee188f038dd47038054c0e

SHA256
cd1ccc8cd7bf1c7d2da2fa3bc85b05f8fa12546f117087cdbf7e86d5665719be

SHA512
15f7ed99243805b8a118f703c647c3217098c912f06ff8e25c0b7cd38b582d8f6eadc60bebe5fe6bfa61c1499fb34921167de558453e43afadc6137705f368d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8b21671c752df1d61ac8cac7c90a9773

SHA1
f04617bcdca752fa94908954f649412cfe05b919

SHA256
7124b2dfcd9783597f91fe7758555f787a3ef68d164d8609db525e39d573fd82

SHA512
95b5cf8aa981261d42b70142d537499ae6a98ffa58a9cbd44ea7d7eae96502e374f4b1b2c93372b178e604078c70bb57d8df917f96a7bb54c0846b5106cb2a4b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
50f0a361e4e1ec7821bc653419875077

SHA1
7508244a38d9a4cd78e09467808d90f98349c4ad

SHA256
ebadb52f6d5b4e90ba67edaa859fa8979dc98d191692a8fb51495db0ca35581e

SHA512
8798037cd704e3d7c48b216740d8d8b7dc180302317baefe657b4ba2032ef46d016f0eaaf34a890ca7ebe0cebaf25a3bc30fcf0a9342324dbf7468ea65f3f1b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8d2cc871fc33c0858b74f432a58b0572

SHA1
9c1bffac6dcd12d232b00cdd3ffe54f5ffc7f7d8

SHA256
1ebabcddd4946964627c5bcebf559b44c014f1c064eb808bf2443a6472a327a4

SHA512
48da64f14ae3361c8ee6696e037bb734155c781de7b8c0b5a1785985103238fc64be295a19face9f75be339460b53ee1bc046df72e216640020c16d67e45c65e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
11895e8ff947a6e428629f8dd0feacfd

SHA1
d3be7f724ed59782d45b2828a60626c5741c75c1

SHA256
34d9d2749fb11c53fbcea873f62559c40f9ad3c47bea5b7c37f49d5e65216696

SHA512
a332b01632006f45b9c800907752238d7c3fe1a6ad37deb8ecd5dd21bce8c43748802ec0271a2ab6663ae96e03432b501b823ee2082ff84b5d31af3ea8b38c5a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c454c335bbcbd73ed40ca7cefb292d80

SHA1
4a1e2478b471ec298aae49122b6d8d5e0f3594f1

SHA256
976bfadc74e5094095a1aca6f2baedc6deaf93b22e7335580f510b9316282cbe

SHA512
7c8d71c9a367505b8d8213029b87b1912a67a3ee6214a11c815f4e2e0913ad4c87c7e47f6e24fb722349cf8da275d457744afbed19cc13a4baebed724bf8a151

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6dcac951e3b5fd0f9f7b61e212f0d32f

SHA1
647baa3c01b06fcb2897add38ca76b4d3695530a

SHA256
1b0ef521759664928e836688ff9eb43c07521ac6bc64163c1f0fc7cd2c3e2007

SHA512
15d1c86fdc10440dae5d18247c42a79fa99dbedfc5fd70141710858f620787e86fbe164e0849f7c463dd03d8e0df2cb1fc71303168d7cc3f34c509f7611ecf67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ccd39504bab9a67bccca42c5f9cf0464

SHA1
39a32d1398d7a170c966e7baaf3cc73022b090cb

SHA256
d3e6d00d1cb1365177c57eff6e4a7217b73536a2d2760e0bdc76c7d7a530840d

SHA512
6ccb81fc053b595802c31535dca887db33288c291a0172c496daf9384fde5eae7b81c9cfdb3adf1df0ac4184389690d82dba3b7fe7a49afbd0da57e8f4c41371

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
704B

MD5
21e9b6b42a70b36d9d0c71e7f6bfa3b2

SHA1
83e7cb68877639378c833105058610d28d11d3d3

SHA256
efcf6483e2643aec456c84eda8befc875397ae51b3d5459d4111369c9235b7b9

SHA512
df18a4e0dd445d63a9a7d5a7d3354961eda396ad92c65a19e78d1925ba1ff0aa915d0c4cc29496ddd233887cf20a47ee0515d4f8a856ff41a627b68fdcb3db5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
ea64ac11cd8dab0d740c44b0cfde26cb

SHA1
d1c5a1d3f2449454bc4fc7fb0bf956766145da1c

SHA256
6d38d0918d0b7721dff5dc663370bf988eea227a0985653e0eab3e82fb7eadf7

SHA512
2e70e846927cc3ca67bc44447bcdcddf3c27d8690a5f14751cc5d423bc90f53f6166f98513fc71ab3d0f2a74ad8f7761b47642a0d1e6eed74ac97fcb370f8bcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
2d1d0c6a7887561a2c192dfc4943f8d2

SHA1
5f8f793fa4b927ac364feee5ad7a3abb47751c32

SHA256
bb9a84b1da8751ac96e3671f5c722736f8bed5252497e24b1e5c120db0024e26

SHA512
dceb9ed47cc84300a74757cb41ba6e7c2e5cb8fcadbf1a5c6289f50d7cb53d1baca96a8c0db74c1d858bb90f639dbe01670fa1ab6b8c86577b674368a2eeb477

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
73402d17a693f17400ac18b08f637399

SHA1
23a7ddfa77879bf37244bf93fb20de912f7db4fb

SHA256
4c71fb0a43dc5b7d42c9700f09f18ed65f2224244b087960241bbf84efd912c1

SHA512
992a6d7daadffd6efa257657cb5f326ad869aec25fe160a62b4e161e9aed33acc0cc362854a863190335772444866c291ff20bd56d46e6bcbecab4537d30ab15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f5e9.TMP

Filesize
203B

MD5
aed79d9a2f1f7cd912055f37f722b655

SHA1
bdd475c5517cde7cc0e48cf9ffc74eb560baa1b1

SHA256
d68b65ae6751bdd0ce23839560b8fdab672e663874683932f7ef52c3a82e780a

SHA512
ff952d9d1fa5fadbcc56dd8df856953fce5acc2fa999aa00a3c67d0dda8489da29303d0ff0da856c7ad6c79195f5ca7f6ed0efd504d49044c94089f963046b67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4a256c3c88d2cc8e952ad33aaf4ddbe2

SHA1
da34fb66aa353c2609f2e84e2c8015074bc7cf76

SHA256
56fe2efda5ffc9f429eef54b16e81c5f93b70648a4bd50dd7247dd29fbf91cf4

SHA512
4be5a886acee77a7f3d8d4b34102fc6266896d949b32384bf397567b53763951e2860c855b17ad5bc0dead92d71b220325a4bec1a7710252717295b12e453de1

Download Submit