hxxps://garry[.]lol/versatools/

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
21/07/2024, 01:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://garry.lol/versatools/

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
45	discord.com
46	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
312	msedge.exe
312	msedge.exe
2864	msedge.exe
2864	msedge.exe
1940	identity_helper.exe
1940	identity_helper.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe
2864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 1508	2864	msedge.exe	84
PID 2864 wrote to memory of 1508	2864	msedge.exe	84
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 4680	2864	msedge.exe	85
PID 2864 wrote to memory of 312	2864	msedge.exe	86
PID 2864 wrote to memory of 312	2864	msedge.exe	86
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87
PID 2864 wrote to memory of 1860	2864	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://garry.lol/versatools/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4da246f8,0x7ffe4da24708,0x7ffe4da24718
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,2250950316656242308,8249113322691017656,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
75c9f57baeefeecd6c184627de951c1e

SHA1
52e0468e13cbfc9f15fc62cc27ce14367a996cff

SHA256
648ba270261690bb792f95d017e134d81a612ef4fc76dc41921c9e5b8f46d98f

SHA512
c4570cc4bb4894de3ecc8eee6cd8bfa5809ea401ceef683557fb170175ff4294cc21cdc6834db4e79e5e82d3bf16105894fff83290d26343423324bc486d4a15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
10fa19df148444a77ceec60cabd2ce21

SHA1
685b599c497668166ede4945d8885d204fd8d70f

SHA256
c3b5deb970d0f06a05c8111da90330ffe25da195aafa4e182211669484d1964b

SHA512
3518ce16fef66c59e0bdb772db51aeaa9042c44ca399be61ca3d9979351f93655393236711cf2b1988d5f90a5b9318a7569a8cef3374fc745a8f9aa8323691ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000010

Filesize
22KB

MD5
015dfbcf0c986f99bc0c1d6ab9fc162e

SHA1
6dff455e6dcdec9ee55ca25edb5f8edd1803f3f1

SHA256
291c3acf9855517f481cf0d64ba43f4e085381d857589ed5fc75905c82133951

SHA512
1d34e7bd775cc7b70371a579de085824a0eee0c6ae81dda89d51500c51eb0163987055a2dbcbd9ea191ee8b35ee0cfe4813bde076bfa5df0428ba7e043a6522a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
d2759cb690317fdadb8d3ae471495a56

SHA1
8f9560f07680ec4d3620ee8861c57f3f6374ed2f

SHA256
ff977daa8a8bbbc9353db3a0fc1b07bbc57e00e8175eb97912895ac6c9976f0e

SHA512
e9ae8afadd95771e1a546f4fe52c40f87033387618678cdf75f401c931bd667d99015289e86951c3a274d7dd0c761099f7ab0da809cec08787a15590f5b1fe16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e02791db856fe3bb57d4580667eda669

SHA1
9950f0826d3e261f1a285cdfab4499867dfc0754

SHA256
dee13339e4498bbedd94d0c7e3924f1981f18cecff612b6e490e3e9a25548a2e

SHA512
dc447759b3eb845d6a59538641847f81bbe9ce8188598957e3118e15401b68188e23fb6c735d30d317fd8ae40048f927970ed3379b311e1a0439f133e19657fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c74dd3729b789238c60e37dad13cf259

SHA1
738a62cd1026b24fb41eb92906762ae7e10d6e5a

SHA256
9d971592cbb30ee0983dc49fe6b033472fe2d56d1d752578072efea1d4e7b01a

SHA512
7a7def7efe770cada50d17eed4bdecd91f6946311a05f9654783e6aec02845d593a07992273a42bb3aa3d642d2864a5bb60fd4e39f28557b05225d46f9119e6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bbb03e2b5ac4d64bacdbe3e8552612b0

SHA1
4b1b99a2fe9587cbe71fb6b3a8aa70eb5a3b201d

SHA256
e6a8ac3000818e062e46ad16a6992b2f33c442ad45b05194a9381f34f27d45b3

SHA512
6bcfa4b81425e7877a54ad8c5b4622a45bf622f97cf856b3c0c8fafaa45e97f122cd8c74a4621b39aebcf7fea6ae95458253f000ecd19784a784cebcc2e91bd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
22c01eb9d18c6fee1a2f018b25b28af5

SHA1
454b8b1cc156a223c961c26b64aaf704c2f87fb7

SHA256
c7445e1a077a77adeaf05a2ee836bfd3189439ecba42ff63d6277140da317257

SHA512
b6e10728f7e50f84a0cea01fb038a75cc6665d0fbc0644d8858df150687ea228882894693d9f0344b8218c153d4eda43fd6c4d2c6398b91f1b157e53c4b59fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9af6090292df06db35b9083645b88c8a

SHA1
bff586862c62a2b46234af97d847c904351ad2be

SHA256
940503a85936e72523fca812de16736ac6ae9c44e7cc169f141b195ff2d24d53

SHA512
37c46ca73313796d4d5c6bdd763df8f272ba8b88d4c6d844303cc3129240e6a6eefac74a8ef5a04159f010ca0299cb247c56687b453924368c506c14f8cb1f6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ee552d8a7b1476fe55dd9839d41a944e

SHA1
d7e693f6b122479011e04f5c7529666b9ef44c1f

SHA256
b7fd9abbe7d8d6e58940f72956d310936ea8b6cdbae69318a4a81da817eb1559

SHA512
da577185fee592c4c857bcab221bd8b70db9aa18b997fcbecfc99ac0f91d3aaf1f945c71cbf50ef43b2a190aeba8d3e1d4f7d754cc9321638747f0b0429e6049

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
38d5b0866ab7c61980e9b733c09b54a5

SHA1
110d1a7164c56c487ab0239af83926c78a2b52e7

SHA256
aa9b93b483287a99a7c464626cfc0a42422c4a103b3650bb900144c1acd519c5

SHA512
97ccbe30016d006648386cf9e7533be1b54a562949f456a3fd6f92413c7b01d929d4c2b95acd118d392336f3ff6ba35bfb95c2f09774330cf541974231445851

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8e1fec86cb86d574fcc4cfa67b7d7bcf

SHA1
35de693a05e8a57f3bf1a62a989d7d2064662a9b

SHA256
42f0077f817315b68dd88742ea50c11c0ab97561e47f952527fb286de078c3f8

SHA512
4fb9f9f9b22074d1a53bd52c1ab41e4720ac1928a8f6488b088c898c2f419c4c26450caa762a8427a607aca04e0975994d4378c695e96dd63fe23d8fba9d6ea4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
356cc75c05bdf1929be8f904c46fca89

SHA1
19709bc419f74afba53dafc9dc1c1a5a1dd5d2bd

SHA256
d204471a0948ba74a41b10d24b74ceeca754d07798bb19b58f1db8f9b0b7b732

SHA512
7927b794cb886bc48a76be913b0acff9c5b9c22fc058aea6d0175ff0cfee3990847a4f76144d5bae74eda25d925332bf6d68512732b00af8fc5e469d2d3c1a57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823a0.TMP

Filesize
697B

MD5
2dad3f72bd631cf6495ae7933bee36cb

SHA1
a1d35fad0eca9d6575308bc98b690f0fdbf07114

SHA256
7187420dad600944124a867d25d8be7ba7def7cc22c4362034b153a821c043dc

SHA512
90e11d99e9cf559e2bab6b238f1ae30dee0303a6df6460f8ae1faea9a29a6b35d0926e96f77157b8238fdfe6dea9fe8dbb2c82532f317e860717a81883e111d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0de9d36af2724fb4815c5ecfba00b7dd

SHA1
3974b322246b25678a4e76417ba6d44ab08482ef

SHA256
4532c4468359a3a0821f2df9623cadf1551aef45e94092455fd0f16b57f9f752

SHA512
391d225e27e8c7b51721a9faee25e071b5a47d2adc2b39583761e5acec2e1b22175d9c8114652a00e6231e1e76aa19c2ecf8587e412b4599238ce0a0c2ad2e7a

Download Submit