43f9b61538ca97ebd0c00aceb58407e62854f0ba5e34a65c6d17dd437472c1a6

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05-09-2024 15:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

DaDSS_Fix_Repair_Steam_Generic/OnlineFix.url
Size

46B
MD5

59bf167dc52a52f6e45f418f8c73ffa1
SHA1

fa006950a6a971e89d4a1c23070d458a30463999
SHA256

3cb526cccccc54af4c006fff00d1f48f830d08cdd4a2f21213856065666ef38e
SHA512

00005820f0418d4a3b802de4a7055475c88d79c2ee3ebfa580b7ae66a12c6966e5b092a02dc0f40db0fd3b821ea28d4aec14d7d404ead4ea88dc54a1815ffe26

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service
T1102

Processes:

flow ioc

30 discord.com
36 discord.com
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

flow	ioc
30	discord.com
36	discord.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1424	msedge.exe
1424	msedge.exe
60	msedge.exe
60	msedge.exe
3616	identity_helper.exe
3616	identity_helper.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe
5540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

60 msedge.exe
60 msedge.exe
60 msedge.exe
60 msedge.exe
60 msedge.exe
60 msedge.exe
60 msedge.exe
60 msedge.exe
60 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe
60	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

rundll32.exemsedge.exe

description	pid	process	target process
PID 2916 wrote to memory of 60	2916	rundll32.exe	msedge.exe
PID 2916 wrote to memory of 60	2916	rundll32.exe	msedge.exe
PID 60 wrote to memory of 3928	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3928	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 2128	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 1424	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 1424	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe
PID 60 wrote to memory of 3528	60	msedge.exe	msedge.exe

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\DaDSS_Fix_Repair_Steam_Generic\OnlineFix.url
1⤵
- Suspicious use of WriteProcessMemory
PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://online-fix.me/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:60
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdc1f46f8,0x7fffdc1f4708,0x7fffdc1f4718
    3⤵
    PID:3928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:4464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
    3⤵
    PID:3044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5684 /prefetch:8
    3⤵
    PID:4016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:1816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --service-sandbox-type=service --mojo-platform-channel-handle=5328 /prefetch:8
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
    3⤵
    PID:3920
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
    3⤵
    PID:544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6596 /prefetch:1
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
    3⤵
    PID:5252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6344 /prefetch:1
    3⤵
    PID:5260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,1401768296610518725,16596352638127719569,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x518 0x2f4
1⤵
PID:1188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\62316242-9cda-4980-a437-7ed8e41c3e82.tmp

Filesize
5KB

MD5
c2cc98723d67b0d2aac39cf56d76974a

SHA1
4b2590bee700380d92bb0268c8d5170831ed51a2

SHA256
1a2d138980230f5166123748fb63e31ea63eefa0b67b0ffd71dd991599fc8dc0

SHA512
76e60f3cb761a94ee37f4499eec09426c67bae641187591d2c5c0d1a6b11c7c42b7c664b4deb79ffdf2b129008aef364e808f815a64dd9a8f3f4d374ee7d116b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
86c15e924fc031bf3e2f0fd7cdf521d4

SHA1
e793b0a8c8cc6ad0fa693e4e09f14abc4c3000af

SHA256
9aaab82c4aabbeb94cd870aa0fb6d8273c8fb2ae09fd64c69044b400d1ed0188

SHA512
3007ec63dfb22cd4d0b3aa203790e5ae0780f118ac2180072092350b3630daabae50847437ff2a27b2814289f1f32995a8b1e22feca595c59550e160891a99c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
57df6f2d5b79936a9575015b53669072

SHA1
87831d75d715c36db0cacd25a337462232ed088c

SHA256
d81cd1203fae35527e4532783b24f608e65f7cfe84788ec8c52aee83708afb2f

SHA512
13568edc40bcb11d4167f10fbdab18bf159ead1ec756e4836b3e750272baee3377d44917902ac5e035cd365cb42a477801badb6b6f3fe745f9b3a8233165f3fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fbe9be54f324f1281fcd1fa3179e1ade

SHA1
9340f372f63813a6ed24c9162cb4ab4909dcf353

SHA256
44743d4c611e84e26a85ee228b72aca40383148ef3412399f30690e849c23547

SHA512
5ba6d65d308ad39786a0f1bc30805b9b21752b6518371208199ece7f0a809add9eafdaf4b02f00c10493a2fa890482b3a3aeb141f8ede3b2598cd1a2670ac3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
39118710eaaf62ada017d9b0dce23977

SHA1
d8ce5307ef8974b3127597754b40b995257e88cd

SHA256
498d63e492a0aa301fa638e71d395ef150e9d8f83c5cfb11bbe15385f3f8d397

SHA512
bd85e78b24ad0c12a42a80757e0daa7342b54b5f039c4b46dac1e4fca36c2b2896adce0d9b6d17ea42794725c975d108d396f0c7dcb87d4ad8d0fd70f2824cd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
767167532f9f95556419f270b43101ac

SHA1
767bfc4c47b4099f0008c4cb5f175b71f66f5bb7

SHA256
24ca9d875c5407e91ed0d796c7e498c22cbd90fd9c6cd0839aacbdba6444b8d0

SHA512
149ca460d331b51288b91b5c7bf3822eced487dfe7353764ba2893194b16e53e4762d3933e3a299f419661bd6c1fd281f6b336cdb88ff1886782baf82a961d70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7eda7c9b27d36ba83c3dffd0c75d887f

SHA1
f8b63e7e0b6ccc6ec0d7c4e3cbd6a85ccbd1b017

SHA256
181899cb5a81d39ed612e41ede4f7e6c188734960aeb8b874fdd231ef4992e66

SHA512
bd0955ed8f6251d76174c76884775011333d95726347608abf7f3e52156978c58329ee914ba86356968ebdb81a7ac83b0ce25eafa69e0d8ed877f6be47e3fda9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
0bc4bfcc1023ae19128c21aefa9ed901

SHA1
19d2c8f980e45f6e64e4df86c8a62862f0c7020b

SHA256
a70f38e0e30ba92daacc909046bd8ddf6fb0170b660495c3d5f4c883f8330d11

SHA512
990b03a79f46cd3880b0a695107b4ab86054998844dbb7e09d691e8a933dd0d46ae81335088fb46893126992684980f5ade3773a43814bbe0a46710939116cae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
bb9893e5192993bfe8decfe0f012a6b2

SHA1
41240680b8747ecc191fd6a05c85ef7963ef0229

SHA256
17d16f4f4f7b122558c6b368d164b16b0f1a29c43eb178cd2a98dfdc64d19380

SHA512
9e6d6883f7a90060d183f9a59d0c78fa6b5763f5dee156f7576677723f731f4a3d2609def6f2e96da74a1776c3dbc9cc0d9a99f4186e7795210cc2166c1ae553

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
a0136496f3f41508e6c5c5ac207ae9ef

SHA1
941c80b0577b587d118c29c84bc7026d81eee008

SHA256
0871c65374ecf6786096bccb4af6f37e2942a225d86cdcc089fb466a6198c137

SHA512
547a52cf55000e8335e594f070a96885ce106e579a37c5611c06f1c1f7b6cf41b50fff3222eaa69b2a667d1e73ad63c29cd0228d3ee47732338db7a206c3eb24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
3KB

MD5
659a4232b8bfceb6724a335fb495832c

SHA1
0bf7139590304c8221c316f5d6d811b3c2a341a9

SHA256
d2f752dc466f57642b1c9c7786cbfefdd5ad5761a007a84d32f5606485dc880c

SHA512
0fc45a1887767fa5bab1e3535dbd33abb120b2672d189cdbc1972cffe1c82cf26ba8983a5d27f45b2b11299b5fde09e83f53b7e61038ccb29d3c620c0ad3730b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d86f07b199bd91414d121bb2bc498d26

SHA1
86468a2710c4abe03002991276234fd582fcabe5

SHA256
0e8382fd1471272dd2b3d2ba733f3371098e1281731ce9c86a6f05ee157a1d18

SHA512
8898aac0b7748c281c5ee1cb804fda0f8ad5ed5abcb1c4239ba0f0da3eebb83705c5b3f551bb2d45465ed4ba015d20e4b9cdf275f4514afbd7a0157d9264eb16

Download Submit
\??\pipe\LOCAL\crashpad_60_RJNTRSSUMOREMUOF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit