hxxps://u3357746[.]ct[.]sendgrid[.]net/ls/click?upn=u001[.]6AfcqzR3fLylasuN0WBrmngKtl1IW9u0MGC2vVVMDB46-2FicUsVVQfM8EzitTRKurGZqa_bf4JG6rVotaFp8XsYJMcbDsTBc4NrHni-2BsbQ1TbQj3mVYqAaFzFfChph9yTUPVJ-2FiHHwK3LuVKL7SainSHeuNsDedHBavBl9Xr-2BB31YM6QDCAT4ixZicasXkyUIdnK-2F2Gb-2Ba-2FKgIc5Ji9-2BLv8dJQhLam2vzOkHRLtznpPGkZTM7sSPxyjd4Ehi1PLYN1CQcpJo9si2b7efdXteQePVDndQ-3D-3D

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://u3357746.ct.sendgrid.net/ls/click?upn=u001.6AfcqzR3fLylasuN0WBrmngKtl1IW9u0MGC2vVVMDB46-2FicUsVVQfM8EzitTRKurGZqa_bf4JG6rVotaFp8XsYJMcbDsTBc4NrHni-2BsbQ1TbQj3mVYqAaFzFfChph9yTUPVJ-2FiHHwK3LuVKL7SainSHeuNsDedHBavBl9Xr-2BB31YM6QDCAT4ixZicasXkyUIdnK-2F2Gb-2Ba-2FKgIc5Ji9-2BLv8dJQhLam2vzOkHRLtznpPGkZTM7sSPxyjd4Ehi1PLYN1CQcpJo9si2b7efdXteQePVDndQ-3D-3D

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
95	ipinfo.io
100	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
3368	msedge.exe
3368	msedge.exe
1772	identity_helper.exe
1772	identity_helper.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe
5280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2392	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2392	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 3704	3368	msedge.exe	84
PID 3368 wrote to memory of 3704	3368	msedge.exe	84
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4556	3368	msedge.exe	85
PID 3368 wrote to memory of 4428	3368	msedge.exe	86
PID 3368 wrote to memory of 4428	3368	msedge.exe	86
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87
PID 3368 wrote to memory of 3396	3368	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u3357746.ct.sendgrid.net/ls/click?upn=u001.6AfcqzR3fLylasuN0WBrmngKtl1IW9u0MGC2vVVMDB46-2FicUsVVQfM8EzitTRKurGZqa_bf4JG6rVotaFp8XsYJMcbDsTBc4NrHni-2BsbQ1TbQj3mVYqAaFzFfChph9yTUPVJ-2FiHHwK3LuVKL7SainSHeuNsDedHBavBl9Xr-2BB31YM6QDCAT4ixZicasXkyUIdnK-2F2Gb-2Ba-2FKgIc5Ji9-2BLv8dJQhLam2vzOkHRLtznpPGkZTM7sSPxyjd4Ehi1PLYN1CQcpJo9si2b7efdXteQePVDndQ-3D-3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab75f46f8,0x7ffab75f4708,0x7ffab75f4718
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2024,120223836598779284,11235721735837697923,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4072

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4564

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x468 0x300
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3a0bcd40-9a89-450a-8ad8-93cb43aabbd0.tmp

Filesize
6KB

MD5
54ec09f8437158e9eec072773b3fa224

SHA1
0d78992408e38ca2ca26657d6ae27291f5ad33b3

SHA256
97c81b00d968a297941943ea4abf17860afcd45477dd36983b9fde18ed1015aa

SHA512
d7c8db54796049adabcd33b0b833e7f0e874866dcea19601c35c8fc8e5306cc83db9f838fb7defd0392fc8835ee4ac03b6d9301668f1ade534416d159f802202

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
873474838e5360d78aee86bfc3c4252f

SHA1
24346413ddb5bfc3fcd6617b1435e99a28c0d373

SHA256
406e2e6c47038ed4384b5a8f6bde89d8badfd7ca098640dd8f426b0a7160ba39

SHA512
7cbb76c8fe0acf1bac39ecd111d890297dd3f98635207bdd0c9e53e5ba8fde8a35e78efcabef7d6e569b4fe435d316e1f86e2e04a3f14cadfa68616a315d088b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
984B

MD5
4ee0c7ddfa5476f023df5d90a0fd7c1f

SHA1
029d834465f687699a5b3204eb3c975eb8f2da4a

SHA256
6ec256d9461a130bc2053d1746dc2e860a1d38d8ee507b8bf53a2124f8772811

SHA512
16192eb83c846865d7d0f32a6146287ff4cfc530c611cec0bef44bc64f0403e354265c5d9d8181b2443cff977f5dc28e7d64ffbff0adc75e6b124afad490eb44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
39b2953e35864e55ac318ea634050c85

SHA1
f5bec18caf4d852cefcee4702b4ee1d0e71e2434

SHA256
ab31e23e624dd50f45dca53a3ccb36b9497a3101e2421c6068347493ba2daa8a

SHA512
c3fa003d5ce9b53fcbb8366b5ecc232ba4c7cf40dcbb7b89eaf7cb081b18b358a7704f8f7b418410fd509654b9922cb3d8363413c59708015d8f78953abf8c27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
409989577518739ef00c9e3db17dba73

SHA1
60fb38cbca6ee663e2b97760e2641cce22ec1b67

SHA256
bcb9474e50834903a7d24c66aa1a7357f46043463c6ceadfd0404ca81f2040a5

SHA512
3c3e48f6e318168135865d9126563638a7d2f7719248cbdc130f8ba24c783f88c99718a7e7bd842339d70e308ac7924d413e9605475b14ace5d8ce95481ddadd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
e55e52290192fc365ec0d1da6cab4d22

SHA1
908ed41a22bb1a77bb83630cbac1c33925f38f5e

SHA256
fdb5246f1d79c0073fee43148445d306f0adac96987d394f9c23c046632e819f

SHA512
24c162dfd293608b40ba66ee27758c32800399ca7225f6f176a25007591fea3607c4b7a0a1adbbc7d0176a97b60d9f2230e0d52d8cf307a2df2b1203e5559ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
d9bc8b4f09441e37dc739d2e03529a35

SHA1
fdd7529adb37b638ca4076490c31e104d0a187a6

SHA256
1be946f34e9b088362c44c7abff8b3f877eb0420a1ba2e9daf8fc1f9efac1535

SHA512
1eb0d5582c007d0224c0827a906776db8758cb03058d7afb96091a5df5908ef23332795849ede0baa573c7130ad50c0ecf949176a6d4a8396eb4b9d51a09a0ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
61dee994e68defe99cd9635c6d4319ca

SHA1
7d3d6441f5c4e447660ab8676c13981904ce4f8d

SHA256
46fa17fdce258e79665ee71daf8ce8baed0a8edf5c9c8ffa9fcde012975eac96

SHA512
1e6b7ab0e04d1a35250571ec2a43d846c5355f9f8f4e7817011901276109e3410d84cf0f4324ce77348f83981b47882c1330dbec705de6ec1358b79ab7ec6b62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2fa7907c78078a01180d01d1b5c843ae

SHA1
b24c25df270bde3227ea63876f07831a80d173f5

SHA256
0b53db1287b09b7ace19cf5064aea495d5fbf00aa936886fd0ad0f1d2e85abb9

SHA512
f0370e0e2e997e81c40838870e44674a21ebe902211ceb43766886ec5c494d66071beb979e660687ae6c584d2326fe494e5e777137ac2ab6cf73875c4a6b81d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
961cd27af221ded4360a8ee7ac584bcd

SHA1
3f5aa2f42ddb852d26393b81cecb53d416921be1

SHA256
3bc343847f0445156c426cad2ca713c4c7a47350b1d6c85eb403babbb59a4589

SHA512
85677f42c54d2c4cabe8e042138f8657000b08f0e8a018b3185cf85f8bacc8ec9c4788a151223ba06e01da83d153e136661fcc8a226be2f0dca861ed4ddf1655

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58178a.TMP

Filesize
2KB

MD5
069b5ed3676d58ed32398a0c2c197697

SHA1
f2840f5a184f628972c0bf208bb6e5e64cca7ff0

SHA256
e6dec4de3cc1bedebdf4f6ca03e66a174594e27862191091a01f8f6b93725313

SHA512
fd0dd9bc86d2b73edccc368ae416a5c08d9c647c1ee30065b07b2c7ea551bfc700645c2965a77feaf0aeb0f62e40b62f0ca5b42129e6aa8fa3abad08b48736b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
95064775ecdfceef7608138bf3494413

SHA1
befffc6c74294e27f058646eb714135cf3337a54

SHA256
2a6e7904bccebd3975b1df5b0519fa3f147477dc6a9445ea00df5c68ece5d822

SHA512
b088041d3b1318f2c86751c4b188df72e2bb376b4f3b0f3d44ee4134a71a63af59b9077529ebd8f60d60074ed025c07d89b62f998df6aeb47a1ea4e2f053014f

Download Submit