hxxps://developers[.]cloudflare[.]com/cloudflare-one/connections/connect-devices/warp/download-warp/

Analysis

max time kernel
151s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
04/09/2024, 13:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/download-warp/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
5032	msedge.exe
5032	msedge.exe
1344	identity_helper.exe
1344	identity_helper.exe
4580	msedge.exe
4580	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5032 wrote to memory of 4592	5032	msedge.exe	80
PID 5032 wrote to memory of 4592	5032	msedge.exe	80
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 4884	5032	msedge.exe	81
PID 5032 wrote to memory of 3216	5032	msedge.exe	82
PID 5032 wrote to memory of 3216	5032	msedge.exe	82
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83
PID 5032 wrote to memory of 3176	5032	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://developers.cloudflare.com/cloudflare-one/connections/connect-devices/warp/download-warp/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb37df3cb8,0x7ffb37df3cc8,0x7ffb37df3cd8
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1908 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1876,2838602707747638298,12045728711470546774,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
648B

MD5
3304ec8fbd2025850f76ae8bf04c5377

SHA1
5ebe7d7ce0fc2cb66b9089645c71894accc55f83

SHA256
d8586bc0d97ff1e8dcc5f4f05ad2c6806af80ce81831eb50205e0bdd5a316515

SHA512
2ff84d0e7c72f64abfb3f4fc7692e1447800b693523b877092412a8e3ef2bc03f5f9b9308ee04164c0450597c849a7924b1d11278e2015433e46339289d1ee31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
5c8f2b6638a8a8d03975b11371b50c63

SHA1
9054329cc5dc5f43db48eae56fff8a21724c6c3d

SHA256
bfb393f9c022cf5791472421dcf9ed2cbc17161f6f6dcd6cab60735446579b35

SHA512
9e838cda1fe86ca3dc0f1d246dda177e64170a3f709b8c332bd2d86820304f9e7adfec20a10f20918e729138a202053910cfd86c4e2f1980f92f1b970cd6cb76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
239722a7fa415d32618fe5f3ecaaaf7d

SHA1
20660f4f975ec788d0521987607ee550e62d3359

SHA256
498821dea92e855dfce6ee7b2f7469f667555d7a54f87a2d97b1a5053185cc16

SHA512
4cd924a62612992d730180ba78c48db3db92f969f00f6176bcecc6f34947dd75a316cf35a049f2befc4f206c4e61ee19efa2f92276967254449ecf4252d484e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1583330ca4a14e0117e833306b38c2fc

SHA1
c2af2b790616b74d35f337081f3d31c0a62de70a

SHA256
ebc02d545ca513766c5b9890224baaada2739d58c1df5ad545344cf5f60c48cf

SHA512
cc222a88c279a29ac774b50b5c8deaac28797120809f428bf0374118ac27d10be8dbac7e20c81a3f8cc2c44cda231748c62b6d8c841516e87228063a72144c51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
580a34ab738d0ddbc218bd0ddd4f013d

SHA1
547d827795746ef6f90cafbd4da4ec7fc91ce60a

SHA256
6f62ca9c6bdf31e0919b75f884d7729b9c6b6641b6c31874994b2f6cdf852875

SHA512
4e60e03511a5b8db36a537336c698395114aeb049a71b8c0b182617a82d346c09b9d8f8e47ecac21716db874a08f65412f92e284a36e6cf853701e707eca80e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d51ec926c02d9c4ee4d60fbe0d46ca1f

SHA1
68b2aba9455009292f0e3b963a9969317afa4eb3

SHA256
ced3aa7ac5da9a06b9f8f4e513d868eb77bae4b5e6aea554c00e4737a8e3f7cf

SHA512
ae453be661af4e99f613732a14bff143712c75e6d03048c49fee069789f8b169b9dfd223c41b91116e8a29382a29a2bf0f5fc75aba32f1fb676c3f5a14aa6721

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
afbc43196d70c08eb30bc0abcf3e99d9

SHA1
f398f91082ca19f2e2d8ec3911b0064eb196cbe7

SHA256
d94b17003185c01607edfdf9cea51883b716edb4b44c1dad6093e5ee70f1807a

SHA512
5fa93140fdad12f3ab013468ed624a44b66b5ddba72238daaf5420d5f4c307d31847f298d60d2ae45345aee9998880054e585f424e874dc66d54beaa45e41717

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
e0071e9b1764b2f6e46551817db14439

SHA1
0ad6f799e2261bf57f372571e1339d9bd58b0666

SHA256
4758bd34557c1498562c98b21abd8928ce2dffd60462c492c03c8baf24b61e7c

SHA512
59c5bb4ca30be10c81f90a6ee84aa596d0b78221506439957cbcd0210a418bfa99caf2f3f26316fb7042b61e538ed491960ac3bfa52272c0fbe1c46a876e0e99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9a6e589f034f04b500aa844c91fc306b

SHA1
80b4d989a1f79d4ef285a3013928477d26322ccd

SHA256
533a18f6b6a8be68ffab5a0d511ad5b0b189ab530aee1fdde5149e88e6f755de

SHA512
645ed303611eb5a5bd2e6099ff1f1424bae52f38704dd150e72b8777acc2529bc63d7bf367aa5aafe3336c19a53229f604b04c03b493dad9bdf7efe0c55780ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57eb98.TMP

Filesize
868B

MD5
931d1fddc4ecdacd6e1f9fcf63e75bd2

SHA1
83450b41c31b7cb99593b734c531405950d0e67a

SHA256
75aeff1a229387345d42d4ba37e9195975c8f7eba86fc360dacdd41018afe92c

SHA512
f9f0341fccb28cac2833e66caa61ecd077bfcac63aa79c7cbbebe187e1d79a35b20402f7b2339c812639f97ee6de12b8c0b241101cea17c55bce1e7974ea4a49

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8b6a54c7388bb588effce6f11f386f18

SHA1
d1d878dc4153e2f261a20fdd58c8dc31a5274ff9

SHA256
bbf3d5868bba0bf101a3ea9c9cebc1d04bdae3b613ac2d896b4e41f0e47ff5fe

SHA512
e8799d056e92f8f9d45f87fd01061492df45fa57290dba4322395e3028449d1f58c402c8ba4fee386cb3d8ee4c40391cee79eb819e23fc0789b8545f99d0af8d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
32269f08b559dcfd494d105d2c0824bf

SHA1
6deeeb68663c2aa87ff5f14af423b0508d5ea763

SHA256
d7aa9eb1be5e0d4d6fca647df20ae1101e9680e07008830bd857347a2d4b2fe5

SHA512
1fd14db73006b182ccdb8fb862f4320db3d1490f7b200210dda0c67043093e4e46e16cc0127bd4dc6317e52ab781436b4b6f35cdb5fad4f0b3a9c87337f04f44

Download Submit