hxxp://url9277[.]meera[.]ai/ls/click?upn=u001[.]MtNHnBlN245AMytEEgSnQoYGPo99yi-2FcPW274dYhVLgCXj0cbfLGWRCd-2Bi9TRfQCdhDu91FutVk9tNFifAQTi-2Fwbdib5t-2FT6mrxC2kJ4RdpyUXHwEKjcG2YlA1oXNez4ri3pRG0B2tXBVygyXvsKaEGjJE3XQ0wKhCA4MOK2ZVo-3DcrQb_y7FUzlXYeGdPOyK7uKqpKBM44HzEPGLeLWkieZGJLsKad677AlUN3nb4nPG-2F-2BpwZfV3vE2-2F-2BjRBwe3MJWgny8rUein-2FXIzpwuXpageln3rvjHPPiVRNxA65jrpZDpmP04sJdBe-2FPCCB80SuHIihbSa8NtLaMxvKw4UE63R0WgJp5Yt1BmjvFK4CI6WE9TAQtsINFZc-2FHvdcVTQtINoKA0wLVTZ-2FHhMS68o-2Bp2GAFfAk-3D

Analysis

max time kernel
148s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 16:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://url9277.meera.ai/ls/click?upn=u001.MtNHnBlN245AMytEEgSnQoYGPo99yi-2FcPW274dYhVLgCXj0cbfLGWRCd-2Bi9TRfQCdhDu91FutVk9tNFifAQTi-2Fwbdib5t-2FT6mrxC2kJ4RdpyUXHwEKjcG2YlA1oXNez4ri3pRG0B2tXBVygyXvsKaEGjJE3XQ0wKhCA4MOK2ZVo-3DcrQb_y7FUzlXYeGdPOyK7uKqpKBM44HzEPGLeLWkieZGJLsKad677AlUN3nb4nPG-2F-2BpwZfV3vE2-2F-2BjRBwe3MJWgny8rUein-2FXIzpwuXpageln3rvjHPPiVRNxA65jrpZDpmP04sJdBe-2FPCCB80SuHIihbSa8NtLaMxvKw4UE63R0WgJp5Yt1BmjvFK4CI6WE9TAQtsINFZc-2FHvdcVTQtINoKA0wLVTZ-2FHhMS68o-2Bp2GAFfAk-3D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1328	msedge.exe
1328	msedge.exe
3168	msedge.exe
3168	msedge.exe
3856	identity_helper.exe
3856	identity_helper.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe
5560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 3168 wrote to memory of 4392	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 4392	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 2916	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 1328	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 1328	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe
PID 3168 wrote to memory of 608	3168	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://url9277.meera.ai/ls/click?upn=u001.MtNHnBlN245AMytEEgSnQoYGPo99yi-2FcPW274dYhVLgCXj0cbfLGWRCd-2Bi9TRfQCdhDu91FutVk9tNFifAQTi-2Fwbdib5t-2FT6mrxC2kJ4RdpyUXHwEKjcG2YlA1oXNez4ri3pRG0B2tXBVygyXvsKaEGjJE3XQ0wKhCA4MOK2ZVo-3DcrQb_y7FUzlXYeGdPOyK7uKqpKBM44HzEPGLeLWkieZGJLsKad677AlUN3nb4nPG-2F-2BpwZfV3vE2-2F-2BjRBwe3MJWgny8rUein-2FXIzpwuXpageln3rvjHPPiVRNxA65jrpZDpmP04sJdBe-2FPCCB80SuHIihbSa8NtLaMxvKw4UE63R0WgJp5Yt1BmjvFK4CI6WE9TAQtsINFZc-2FHvdcVTQtINoKA0wLVTZ-2FHhMS68o-2Bp2GAFfAk-3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa797e46f8,0x7ffa797e4708,0x7ffa797e4718
2⤵
PID:4392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
2⤵
PID:2916

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:1328

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
2⤵
PID:608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
2⤵
PID:3796

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
2⤵
PID:3896

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
2⤵
PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
2⤵
PID:4692

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3572 /prefetch:1
2⤵
PID:4032

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
2⤵
PID:3560

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5828 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3856

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
2⤵
PID:2360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
2⤵
PID:1720

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
2⤵
PID:4460

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
2⤵
PID:5124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,11073922179756925846,4022685929258231837,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5208 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
96B

MD5
b2daf66f27f456c62ceceafd2c86aaea

SHA1
481d474807e05243f4cf4f24bc8c1c0ea0493f2e

SHA256
cce439877b949fbcd0713a2c6860c6ad02ad5c675d4fe53b14f2653459645d9e

SHA512
9aa391da6767baef9fc8744f9c34941d642494343cf9a50dd719f8d304fd8e58a955c63739c1879191536aa8d64e193df98433f20ee8031d0ca6a724ccffb773

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
4KB

MD5
a61e314f4c265c2d3e84ea9ca1bc5dd3

SHA1
7d88e1fc314797b6f891e9e4ce3c7dc0debd5c67

SHA256
21a31f08acc6e2040acf8244715435bc59938d5f80ed5ffcedb7beaff0b4af05

SHA512
5a39b8c77c5ff15366a6cad70b6dc2f6aaa0f2885a4487ff9b29f049f658b912dc10911fbf3b92df229a1dc92b00afdcf77f62f9577d8ad91f5eca432940b136

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
3KB

MD5
e436c8f8f8ec0e022a420bd03732ef2d

SHA1
5de72e2a5f9091393b551768d9f4563e2af97777

SHA256
3d05bdd7a0682815511ef5cef1f8797b58d74369ab3acd2c706893406bb0f155

SHA512
53e29888421a58e49420a21c09b86778eebaf7d85965221a4b9cc61df1179bcab3d282d4a5ea5fce3ec60f731471f62f37270d1e65c2e7819000e8a9c89614a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
b85bc2dfb99b885af8dfcc51c2c45ee7

SHA1
af8a9ee139e3aa5bbd81ba4c981b64d6c10f74ee

SHA256
f5989557a5123a0f335321125df6a5ed33b4f7be6777bfceea0335db0b24dc7c

SHA512
c9f1aec61bc969ade8c676358d42b3ee2eab4c7c2d185a5616471798e4b84630838b765745ac5cf0beabd2d2d9a2139c715e7227a0ee6ac411e897d5419c661a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
230d5dfe2854ec611c59d321d896070a

SHA1
51631fd2c0e6a4d112fa4290110b1ceba950cbfc

SHA256
c1ba264c523cad73d5623e13257c8be6a3e97aa31477ae44a01df98c4a56ddc8

SHA512
0e3dd812c390f817015b72c78720b87d50e59d5c0d4f32f3310f1a6c9efcd986708274d167199fa479bfd836974c11a5fa20e4dd10992a6d88d3fb7f8099e470

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
7KB

MD5
1abecf67d271ee738b61751f1a5ca1bb

SHA1
a3380194c48ac02cb5cd37ed2acfb120f2f804ab

SHA256
5b81ad4adec0ba4642dce12b49a030fa21f6e3ecf6e6dc17cad6f8cc95f5fbd6

SHA512
39a691331616dba322b1cfc0bccbdbb6d765a689acc8286b7b29c3821ac0c91253c78975ffb1b67bd54f7acbc34b32161364afdc278a15f11f0313c8a18baf11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Filesize
72B

MD5
876bf31f0d7dd71c679fe57e87f2a0d2

SHA1
93f77a002823d1a79a3ff003aa49bd8f50bf2a92

SHA256
e70035815fda4da372d2468ae28bd5433204f8caef7be1b28a067d6145f440d9

SHA512
50cfccee076c8f2a14bdcaf3d426ec19b867e6ffa1fc3b9579cca3b3bdb29c834b96ab5cc22d56bc6950facb6c100f853ff501e60dc61f96e19fd77e35b5ca4e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57b93e.TMP
Filesize
48B

MD5
5500fac2ae0a952095f4963c22fa16d1

SHA1
1b5398ff06718c92613674b85b87801200ca475c

SHA256
54f237a85fb14c603fb9f9432d1dd0c1826e9c5737c155422113538b8a2e77ba

SHA512
6f4368cf4881b7e644505ac0126cf463d05616cc46f6a77b2fcaa1c7d35f61887d9585d2d9337156de6f4f481b4c5ef8c273a716ffcf3d3062107334e8f391c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
4b64d20170708e3a2c6b4ef5ecd9783b

SHA1
2e19f8930bdb2f56496e17bcc06a3bec110f0092

SHA256
c4b7b4a543d4f48a9f83eb20a3dbcdb6e1183b5bdde12ba956e4bd775a770d1c

SHA512
bb5680ffd59dc630c6edeaf488e5ee8bcc04485aabc5eaef7f0943c0c954868605fc986f24a6a00c762c65dc69c0c64af18db5393160282eae327cd0fdf5bc84

Download Submit
\??\pipe\LOCAL\crashpad_3168_DKLLXEZWRHWXJEYP
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit