hxxps://thepiratebay[.]org/description[.]php?id=75516906

Analysis

max time kernel
589s
max time network
600s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
06/06/2024, 11:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://thepiratebay.org/description.php?id=75516906

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
1192	msedge.exe
1192	msedge.exe
4348	identity_helper.exe
4348	identity_helper.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe
2396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe
1192	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1192 wrote to memory of 3224	1192	msedge.exe	83
PID 1192 wrote to memory of 3224	1192	msedge.exe	83
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1624	1192	msedge.exe	84
PID 1192 wrote to memory of 1832	1192	msedge.exe	85
PID 1192 wrote to memory of 1832	1192	msedge.exe	85
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86
PID 1192 wrote to memory of 1076	1192	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://thepiratebay.org/description.php?id=75516906
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffca1246f8,0x7fffca124708,0x7fffca124718
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4568 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2324 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1124 /prefetch:1
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2580 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2568 /prefetch:1
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,15902454917889766006,13867190606295909998,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:6008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
79a06fd1b01e38ecaa64395ac1af5550

SHA1
e0f9c942063cd5988765bf0c8f8fed479d6ac79f

SHA256
bbc4747b904612837fbeb5716885b993989cb6a2bc67fd47bca077b388bc1504

SHA512
acb80f9ad908c36362a08ba8a449740aa0f4632c901237499b3da75120ab2a8050552f83d3d7b1eeb2dbf8eb247dc0790604df72ed75104653a0e468df4bffc6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
0298d1e4dbad4b72bc1e50c5c4dbdf75

SHA1
2de3903f70e75c65e390bebfe3901fcbd6077e4b

SHA256
af0a2d3fc45006ed71112cab5dbe177ee739126b072be3c8783f8a6b1bcffb1d

SHA512
82613bb8cc56ac72a8919af8b3447c3b494a22b7447d5f70e214f2c5b9ee4e5d3bec43edacfd4ec3135a0fce6af2834e06414051e05eeb87e387d9008b95c441

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
9f7b9900b2c499dabd1c37e966127fe2

SHA1
8083fefa56dfad76ee6ef79c47a07324840b9710

SHA256
062c629607cdf6562a7a79fb89e80509f1173c00bcb691393e9c11ad60b414d7

SHA512
cc7d4e9cd8772bd3df191af70d95febf517bec24b8b0431ce4c8dd65f3d09a9ec17296a61451b75ff2d5f42ad87dc2b98cebbb12c29567444ebd00e8a4dd5574

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
d4bceb6fa342d786d649018ac92dd6c5

SHA1
e150866cd98a02affe873e5d4cec7a97915db68c

SHA256
fdbe04c07997cf8d80755d3edac026a52cee23a6c2ad0eadb0cc231e8a9d904e

SHA512
4b598eebfc81c1e292579cd03d95f1759dc02c9abc0f76f26af91b3e063dc1d51ff3d495f30a8598030a6f42135ac9dabefe9d573496f872a61f0412279a1f3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
4f669ff9cfe1bceca240f61e71583480

SHA1
e675343a5936c20f2c4c2a00163abe83fce003cc

SHA256
2cebd1abdbbeff799abd7f212eef8d6ddcb0a4c93b8a718d8139d8f9c3d0b5c4

SHA512
03ddc7f82a712bbfbf4029fc72426c980f726cd046270383d91bc789587840d9cfba7167674838831983d30ec7a9135ddefd615060eb8c5d8ef8efd97af4bb95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
623B

MD5
5cbff729343fa33d903c5543fc8c5ad5

SHA1
a0b3cbdb9aecd3f105ad7ba021e76ddfc1979b52

SHA256
f664a4c1cb826ca4dac83cc1c6c5235b95860e29b8ea28a71fe7b7c58cf64b04

SHA512
2139ef8280925a68557c79b5cd6308ce922dd7ac5cf4c0362ae9ddb598a347b7139f31abe5f56226d473b13b906545e0e41c16a77928e38acf7e8f5dfbf06a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
623B

MD5
0f3484bb999aa3e5fe0016992fdff4b5

SHA1
3d22c14c9c2b6e7f7b7e5c69ff6fb533eb1a6178

SHA256
22a7734823caabaf23e68c040284dd74564ed3907e10a9662e72d6e083694085

SHA512
55d90f7781ed873aa89b89c186c24958d9c74a08a21ecd7915b2f0883383a7734876c55ed37413eb291237ae30be7a96b29df6182daf08d87986e3191f97c8fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a5151d07ed7e51d7f10b4cd3955b2202

SHA1
13d635fa78fe8d169f288b94cb9be55a8af221b7

SHA256
cb30a8f8a1c1d1641b4fea79bd32399689a9395cf4e1cda3c087e01876149d15

SHA512
a83c7b737f2f274ccd3f88bd383a80c1180748134bc1ed4209fe7b9dd240d4883a355b6229e4af038d4fad163a158a21772cbdf4a52c053730bcec023aed0437

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
da5bab6b3729fc16ce3c337f6841d920

SHA1
92d18afecffc0660942ff0df02c15647fb46f0cf

SHA256
4ce92a1d250ccf5344db49b1fba2eef5910919648cc9e1786852e1b9f599d93c

SHA512
c73cd05abf190ef1f557b26bed4ed0f1e63a0901640c94560208b0c58731d2c2b2475ab04430c4fd74e927dd7328253bb88c993731ed0513e43142f7b584c865

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88e47b77eaa5ea1694b019a471fa06ad

SHA1
d69b52cf7b37184e8403a8040547abff17c5584f

SHA256
d3133d6de24d00d40c450af7d6978c395b2f945c64d4b4161812e187681aa6db

SHA512
3d4984c28b1f0ef5c00c8c01a3605bd3aae74326a853ef9e4a9c0cab6496f76616b62d8ae8330b59954380b348490f9541a63cb847049796383296911f24d204

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
86dbeb291caa7b34b61c3d3d07e94d92

SHA1
a1d227d86f8d67414cce6556a2c7c83500af24ea

SHA256
f2bb4ca5a5d08b655b104bfb54a5b705d7a91ccc24065e07929919b4c8e646c5

SHA512
7a71fc856e6f8f42b94d4b910628285c623dd6be92432eeb2af1106fa63274fd2305e244e2b7dcb022c1e57878108be4060a141c70fcaca81db3ea8000d34120

Download Submit