hxxps://t[.]ly/390

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 15:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://t.ly/390

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4672	identity_helper.exe
4672	identity_helper.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4596 wrote to memory of 936	4596	msedge.exe	84
PID 4596 wrote to memory of 936	4596	msedge.exe	84
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4524	4596	msedge.exe	85
PID 4596 wrote to memory of 4328	4596	msedge.exe	86
PID 4596 wrote to memory of 4328	4596	msedge.exe	86
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87
PID 4596 wrote to memory of 1588	4596	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.ly/390
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc136f46f8,0x7ffc136f4708,0x7ffc136f4718
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:5620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:5708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:5528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14934715363377802113,18395165510941505959,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
22a84f4012cb003cb7179dc394ecb8f2

SHA1
e21430c1b9336933fd514577bf43ab0d518cbfb9

SHA256
21f9ae403957e0270eb6364284b917d22cddb17df5d5b88a83f6c586808ec5b1

SHA512
6f0d7fcbfdcb57a69c091cf60a001d7cf4aa2b15ad39fe3a25f1af68c3af07d3d78e6938f3a7232099557315487ea8021ba1bab89bdee5dc887cab9f2f141531

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
ca5d1bf71b9f7c9d802e02a6f0f0f3b2

SHA1
562ed7bd3d289d8b04ba4651cdf28a96c082f8e2

SHA256
e34fd62d51d6ac75d610c802446a9b6fa53503d39df4ed80ab1c9aa4c2157fec

SHA512
9bc0f8454f866f76b8ad69f77f70ad41e47dd80123fee8777830a7019193cbb4e3d8c5bb03ed0f87606a69a3afaed9ab6ff523df117669086df96bdb492fbf9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
53c778a18f22fb48860459ebe2487c6e

SHA1
246e96d755932404e43520d7c5fe4effa8ce70e2

SHA256
e667aff607a2852dd0b4836461b62c5bf69dae69405102fb5b890649920b9e64

SHA512
bd0d9eb2e8aac12290f5b89b6199ceb082f667e593a286644ef9d8d8dbd03a6c145a780d4f5b317742503234cccaaed946df89b92e2c284078e60f419a83f60a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
342B

MD5
f2fdb888419fbeb01221bec0e31542d7

SHA1
a7c7ea55396ac4046eb973e79dfdf661d84fb835

SHA256
19ba4a56d687a4353726507bb1bfe339982027ebf30993a95caf631007a1a187

SHA512
04c4c1cf44d8948938a1c2dedb7d01d63b5662c979620a320de7c9932318aee5162579d6ef59432ac87c2eef7637c986055fd67c240216e9888cb01962433c28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e44e1c4c2b9b7a674e5ec746e6644b9b

SHA1
a66b9fd74636137539f44701e372bd9e6eaad80f

SHA256
c813d15d7742205edc5b0ad0c8e3840f6eef7bbaefc5e59853211cf4418837d7

SHA512
f3a502d5dae2f9dd44e567f01b232268e0dec1925fc224119b56f797be6be91e4271b3802cca2c8e6b201d4292094d09b38a11ac2c70fb084e2f9fcf774013cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d346112d9d712fd7c518c8aa770721d2

SHA1
0fee619c3d45c2e47e77eb48ed0f32fd0b303310

SHA256
7fb6aeb31e44a6678882e88c7bc8044ef28888ae8a68ca280999eba2bbf64de3

SHA512
8044fca2cd3a08a25a1b9063f302db988090d7257528a41ad242941f21bdd87c7b5f58441c56d08e786417dd39375f4ce3fb23ea3fb9bfa4f1a56f197d1ea341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ceabc0c76e212257dd99a49962ff279b

SHA1
70731db96006b409a1050e312c6017cf20969095

SHA256
4d7082f4ebaf7fb4c699565be38f29c7ffe87b6ffd5285a6e2d3d9432fa8a110

SHA512
d526599b2fc44a1117372e0e33d5364a4ee3f4c909e8828ba2a5a809bccd8b342566189ff58e7da7f3e79bd2ce4298053d2cf4f2fb0fb34f37a303491e70fd10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
7d37e721bfafca3ff06a351a891f385c

SHA1
fe4c4882de248f0e3ccda75263b19786c3f954ab

SHA256
bffb2fb8d9886983c77b95110d0746a2bff201cec27a556bec22ddd27c74a082

SHA512
9f752ce904cd6d2a15b176924b073a4eaed90aba1f12aaf459fe96d79af72725bf93c8c5ebb3f618a403288a04b273ced4cc192f5bf89b2b17c2d94678b63bae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
0d35c6cb6436af1ffad503f167f8e05d

SHA1
aee128473ee5f5aa885772342a0d4f841e6de9f0

SHA256
e28c079b2d2a5051035ce75e88613c30a2ff16662b7677a6e4950b9cd90b7524

SHA512
180ccd7e5350b8dc451ea3ff052162c5c603fc553c461cb1c1948170d0f5bff74c8b2c8c488c75d8e4d90863208d265c9d1e2a9a77e1703187d5296d039a5386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
6d606441ac9e06893ace6574cb4134b3

SHA1
2290813e77796a79d029fc2e8ea5134cc441c70e

SHA256
fc1323fb8ef8c1026be94fae40fb1c5fef2570922bd0bad416860144717f5f6a

SHA512
b0f7295699a09fdf4196a02618b2635a706565c4c8a6f86ea7bac27613fa6bf96d321fd5cbd0e680346936ec5436cc4d587f147528b448675f715bcc6df9092c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
203B

MD5
3331376c0ee59a5ddfa95b05d4e6ccbb

SHA1
0ff0024606f54ae5a0a58c4c13b3b7d398dba9b9

SHA256
8c1eb9dc143af44a7091db5e4b51e7dc3e232521379b97410764b52b0b5e409e

SHA512
2632c55e89da1479317e3e2b31eb48cee0edc40030afb12d60ae57033292d905b6747aae1b19187e4d26dd7f7150cd52f18366cc88b8f174ccb38233980db82c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5849c6.TMP

Filesize
203B

MD5
baaade2ad87b1c54c67ef7928bbf35dc

SHA1
d9645196ddd048e72ed49ad47bac7129d4998b4d

SHA256
4e11e1da558b1cf0dfa13dd0e558411e2a5b094771b89241a62630caf0d970da

SHA512
e3cb0b61d4c36480a84a71c488c47c34f4a701cd2fe862d6d28c9d5bedbb64e6f059698e60688c4f350d3b1fe0e6f5306d0b1c9f6c895dddf28d9054ed6106ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
37177bd9db7b5f9b9f1a383426e87c02

SHA1
eb65a7f8e953bb33b1fd391e165028cc8f659e94

SHA256
4f05bd51fa4f45640c3f7508d882ef08c3e458098084333cce43bc8406447307

SHA512
7295fef3ca8be69ca7282c57bca75475ad46cd678bebe741199268d975d66f0382598779d4c4979f0f66ccb195f34ebec39a6eb6efe0bcb7ee2495eb7e6b7765

Download Submit