hxxps://llaun[.]ch/installer

Resubmissions

14/06/2024, 15:13

240614-sl9tdswckh 1

14/06/2024, 15:11

240614-skmx8swbnd 1

Analysis

max time kernel
360s
max time network
419s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://llaun.ch/installer

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2080292272-204036150-2159171770-1000\{F998BDAC-DCFC-4A02-BBEC-E09216EF7942}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
1332	msedge.exe
1332	msedge.exe
4660	identity_helper.exe
4660	identity_helper.exe
656	msedge.exe
656	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe
4084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3664	1332	msedge.exe	81
PID 1332 wrote to memory of 3664	1332	msedge.exe	81
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 2408	1332	msedge.exe	82
PID 1332 wrote to memory of 884	1332	msedge.exe	83
PID 1332 wrote to memory of 884	1332	msedge.exe	83
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84
PID 1332 wrote to memory of 2960	1332	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://llaun.ch/installer
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff959b246f8,0x7ff959b24708,0x7ff959b24718
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2228 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5048 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3116 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,13327501332462799566,1576551359448201959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
16KB

MD5
f1e42f23e232151e37e190eacdd7727c

SHA1
d7fb4673ddcd63e98212a68776dc25b6d28fa9f5

SHA256
d9d8890cbe90e925f6a1414928d03c6b69bcd38e3f7be87b1c171fe52d226f0c

SHA512
5c984fddef22f9af697ad6ad504190e152ec09852eb7f9b6967a560f823aa740cdf4ad5385a36c22ec8b4d758c8a34e8ac93ccf5e289e41d249f246c45b7a38c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
19KB

MD5
60fa0c40fa48682969937904a20f9690

SHA1
ef95e2838832c60bd319187ef9adf02cf1705803

SHA256
0007d746ef6abf9360b70a15e3788ba327b6c76a6a345d3bf51d104cc32fd00d

SHA512
2fca1a07a46c298c51af92813aca0577ae0eadc09421bac1853034f19f0f2532c7f27460b217f92530b0a46d62e9fb5301472808bd0f0696371834b4ba96941f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
ee770e8bee8b3b0cdf82903d5a2f6147

SHA1
6e08c80b9d2b78fcb83a1a89c1006d1840dcf565

SHA256
64155f3bfef36e091b311478d7d99ef9ac4a581d0146866b8625ba2f8d891c3f

SHA512
3495de10cc852a1a3924f8537756a42ae47bcfb84112852807f7519d2b875d6f587e095e9528ed9e7bc190f48797810ebfb1584b8228032365a9bc60581acf28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
c76367e4499869eed8710df4c319e56f

SHA1
19a32641acfb1e1d8e920e3dd2e71159a67eac62

SHA256
614d8ea49dfdf8e719c0082033ca3122422ed6e67313d1de25c19faf9f5efcac

SHA512
ce9e4dda84718b1d6ae3ff4da23fcbbc2beb5f58b25a26636391bdd3f87c66975e764e1e43aa18a21f7ebb38108680c545e8ac51e006ad0ba5b10b1df98358f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
893B

MD5
d90d2f344a39c0a1fa0996025a15f44b

SHA1
72e3338beb28f7eac36e09d8bd7d4c131c532803

SHA256
5796d4c01b3b29c1ef2c828677fadbcb6ef26bea5592c3427152f47ea5484c3c

SHA512
86f17ecf36c31f7fe219bac96b4219b22529a72c65d491fe80390475ee6758fbb4fec57135646ecf8ebc64b53784cce6b52cf547ec1836217e8e45ba1656f411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a47f5976c4d0a2034a72e7d2d235ede7

SHA1
aab711550fb00a822448882c532cf20476bc58e6

SHA256
ba64c572e386303e813d51a19f6cdaef04f789f6cb5aca6fbe7a1b83f876e0cf

SHA512
ad78cfb41f474a4f310f05c1f3943aafe79342ac4f697ffa179143e6d460dd4dad9f78553012b4bc03813489b9a2b83873d15dd042094bd77e7e254913ae392c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
86e033b5ea30d7ac073a37544b5065c0

SHA1
2c1c467968e3bd6e01ba1d61739d007ff696251a

SHA256
c0b6e0590630c978f424ad50c6364244b9c8eac6dc2fb7b15cd840dc7950911b

SHA512
1c2f705bdbd7fb3ce420e59da46856f07dda5678afdcc5db7577e5646dd4ad1ee34bc975d33b92c4321ef2d01598c7764cdbdf1148d2a8e76db3e72844db813b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0c7e0ce400f98dda970b9464b55c3f6

SHA1
7a70e85e0070ce287fbd87163bf6a417e3675312

SHA256
0ebd0c831f99e3690fd74530c5ebf7f78b729f9b62fc982e9581e190dce58438

SHA512
cea1fa05b742b89990f3409c926ad645d7c1078e3b09ddc634209ff5639f42a8942493a636eebeb2dafa86cea5fef79abfc92293b77b92869fad04f55ee405c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
452219194af0fd08bb885f8389346b5c

SHA1
be143bde852b55745bb8bc024bf4aebb7995de6e

SHA256
c25aea75f91dd5cd822cd34d27e07018cb64044f818d4b59c1466b29d7d2da64

SHA512
bec8c65a1b8fa8e1a53d5d58bcecc557355abbee16a9b665c10c450744ebe6b2ae8faff5826721a399c692fe3b5878477e86418573ed682945ba4581ac8aaa6d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
539B

MD5
10e48ef584fa054f15d952b6cbe22466

SHA1
e18ca6b850a74b0adbc2e0b3070df595c4dd6269

SHA256
9ab88b4bacfbe8cb4c08f2cab266d6b6bef194b5f7776cf1a461311fd8382887

SHA512
36460f29a69066697a44fd8ca532c7b405a042ed8a56cd5f78ba98ed8dfe1e2d147830bf92a03fb60b55f25bde7296056cfdd8e7da880dba24f999b96e7bd05a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
372e43144a5227e9a70e19326dfa2e91

SHA1
4e4420ee8369f5112704398ee63e13275812c374

SHA256
addd99c12fb4b533e7fa08ff6f1f1434519a55c7b4cb18feecceaf0380381b1b

SHA512
a1f8ddd9056724f32fc6bb9693b8e6629128031056db7e10d960c8599360c5d6c6467965eca99e9027bbac95183b1ae1cbdfcc07cb4975a8c78384eace921b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a2010d3c3a24d160af4d6855655d7bf1

SHA1
8b1a8095cec497a67188d7b5924962bdbe23e073

SHA256
cc93b958ab9722b6df53fd61c6aa0a5635ec848812d12e7342d6e1230f393681

SHA512
42ed3efad8ac081c5b2a655d5bdf6432448bd86958f93c7c424137ffcc4efece44741cc39ee99dc536a8f0a00a6fb509215c7186def452c3d632f4070b32c001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f0fc92caf3375b088a55cb84ae23ba63

SHA1
5062d2eba1abc6eaf8ab968a341210173f0e7a0b

SHA256
0900e7c375beeeec41bb701d323a31b0ecc516af6b45f34d39b04cc2c6b6cb81

SHA512
d53f637cdb235be41ef4acac623992dc4a66702c6a70ed03246bb32b2b30da41d798af6e2bf4ac51d50e4048c68dd537f5786b62861047814b3d3c9f068ee11b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579e34.TMP

Filesize
539B

MD5
605d1fe7df6d49692f0ff8ec5434c657

SHA1
a0bc98517c969695b1ddc143995e5afa54108871

SHA256
b57adc92302ca46e4d44b00a52cdae6a07ddc52ab2a0f730e74e0b996d3116a3

SHA512
9bb26915dbdac2be5b3f8038eb3493e9b11b63e5ea21c2b556b4a853ee7d24d1df7cfa4f52e7adec6175c001ccb90049dbd792fd18804d509b9d2483b6853ec8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_00000c

Filesize
20KB

MD5
e8e1f8273c10625d8b5e1541f8cab8fd

SHA1
18d7a3b3362fc592407e5b174a8fb60a128ce544

SHA256
45870d39eb491375c12251d35194e916ace795b1a67e02841e1bbcb14f1a0e44

SHA512
ca77d40ec247d16bc50302f8b13c79b37ab1fcf81c1f8ab50f2fc5430d4fabc74f5845c781bd11bb55840184e6765c2f18b28af72e1f7800fe0bb0b1f3f23b24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
061ce3dd0a724d1762537c3d0ddda48a

SHA1
f6593ee40eec69f8f424d74019535c65253c7555

SHA256
e45ad43847524b11f9bf692df2273f23fee373d80e011202a867718dc26426a1

SHA512
6f872bcb88df31a1cd2745a347e3163071cceae82c856a9c01dea64241c94c129e75d739c4ac07b8b205aeca9751c2d4a3df1270b0c149eabb17ec6cca1ed859

Download Submit