hxxp://fools;[.]cck

Analysis

max time kernel
601s
max time network
606s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
15-09-2024 09:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://fools;.cck

Score

9^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe
3624	msedge.exe
3624	msedge.exe
3392	identity_helper.exe
3392	identity_helper.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe
1448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe
3624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3624 wrote to memory of 1144	3624	msedge.exe	83
PID 3624 wrote to memory of 1144	3624	msedge.exe	83
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 3100	3624	msedge.exe	84
PID 3624 wrote to memory of 1160	3624	msedge.exe	85
PID 3624 wrote to memory of 1160	3624	msedge.exe	85
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86
PID 3624 wrote to memory of 1724	3624	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fools;.cck
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9a7f46f8,0x7fff9a7f4708,0x7fff9a7f4718
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4600 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,12346548009958672617,17514480079175583988,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2980 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:216

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5032

C:\Windows\system32\cmd.exe
"C:\Windows\system32\cmd.exe"
1⤵
PID:4752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
d1f604157b0745a40453afb93a6caa42

SHA1
3d5d77429b03674ebb0ba34d925ba1b09310df5e

SHA256
468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5

SHA512
0644ce93724a57dedd8aec208e5a038e323a1b9871d5046d58a87c60479626693e6c8f25b7c7f7b60fd35aac133d2e660ecbd8f8d579ad1fc6703ae117a485a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
a410fadc60ce03a74c5a8555d4fbc480

SHA1
d3bfb91547385eaedc62b248b1c9c4719190ea33

SHA256
31182a5df6e338dbeda22f497fa7fbcec0c3bce82cc554e9d9c42ee4bf35c757

SHA512
e4d0125c90351c0868685286fdd98337e62900242f4bb63f261b242a7dc9ea0a6ecd47a3928f3aa218d0600c7f5c42120555a8821f21d4af081f9b219118d2c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
9fcb17765974b6b3cabbf95a7c541c4b

SHA1
f4bf1b73005fdcd22ab7ea8e755e50d5662c1a0a

SHA256
4020bee6e6623b9f98ce29ca280c8425f01be2c2f6a45e1a3958d0286975529b

SHA512
e34697825ce0db521f111e22d306f89c5898b0cac447253328f19f5be497906ee5a088eface612e20135cd1756c4f05ac68506ccda03bf26cae7783d15b905c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eba0a56b6b20256a080d1523119f5f1b

SHA1
fbbe0bca61be7d5f2c970df3295eaf3d50a320c0

SHA256
1570c9eae3ac61de2dee01d37dcce3a883c320c3e060bd56dd176eed443a6bc7

SHA512
e5faa40cc3410d109e9c4b7fd43a9fa710eecbb43c804fdc33a33001e5c517e35b3e52a6598ef4c1791aad179a39c6a360188e5d16d63cef6cd1831f509cf703

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c5a7cd4426f0093d48e632f7814ffa57

SHA1
e92105390f3357a75517e710c112ebb34b4c08f7

SHA256
6093ed2702cc3591d4e9cb7de05bacbe29d9e829ff87e5b275938f0764244acf

SHA512
fc4fafc27c28286f5090a7b9d7cf1368bdba0db14236eb29d1a2364ab904094844894038fb31842d80a617d08bb814a006493f2b8d5b181b1bba79bd4bdda8fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6f40044005f8a98310842da2e316fbed

SHA1
5cde36e86ab85f2e87d1a5cc4c02ed7e7ad3eadd

SHA256
bb752e15d804d8a43d111ca561892ee23ae1dbe17472036ad262052177c45f29

SHA512
0b40c254b04cf472753d62fc4f987799453a376cb9cae37f414978206db742957b2c3980325d965c547114f6778dcbf98be55615ae5000edb8c915eda3ef0dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
1e863e290ec2bccd48d0746fae3e4fe2

SHA1
fe1f5f2ac1032d6c1b2c34962cda0f92521edd69

SHA256
dbb0a17551f6f7f3a194eb33c824e44d558c8909b6acf308f0124cd44c7af187

SHA512
96eb60f56be23a41f9b2278cfd102a7b3787cb4ce935a8dfbd1ccda62dbd4deb7910bca1aedc167c6154a47127dc819c847d671cb5195523706077ddd30fcf15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
52c76bc08736717b28c644a96371ce55

SHA1
3d22c94a27d416b8ba555256e44386bf8715f1ab

SHA256
11b6239e13c8743576aa8d191ec5ecb4845330cfca510b5e53ab78dd7d343831

SHA512
96161d448f2c955d9abd29c04d4a7719f7a3e4166ea22661b8a4650f4ac8f4f1158d23f65479377aa77aef13e1114117ca4be9287a8c8e9b40d0e0190664dde8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
a3254dbd57f370b96208d18d390b51eb

SHA1
0351a38f7b8cda6fb275a046c682da1324143877

SHA256
4d4da8cb23e5949c3a0c6724e3b2239378fec2dd51a2c4b198d0b0e83da8ee18

SHA512
6a379dfba1fb9f5c28ebb0e5a34afcb802e1b6aff26918bffa349b34b0cfb8900438676550f9a9d22c2645ae1ed7bd520131e03ebe6d9ff3510d67060d50508f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
22KB

MD5
1ac9e744574f723e217fb139ef1e86a9

SHA1
4194dce485bd10f2a030d2499da5c796dd12630f

SHA256
4564be03e04002c5f6eaeaea0aff16c5d0bbdad45359aef64f4c199cda8b195e

SHA512
b8515fb4b9470a7ce678331bbd59f44da47b627f87ea5a30d92ec1c6d583f1607539cd9318a5bccf0a0c6c2bd2637992e0519bd37acdf876f7a11ed184fb5109

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
838a7b32aefb618130392bc7d006aa2e

SHA1
5159e0f18c9e68f0e75e2239875aa994847b8290

SHA256
ac3dd2221d90b09b795f1f72e72e4860342a4508fe336c4b822476eb25a55eaa

SHA512
9e350f0565cc726f66146838f9cebaaa38dd01892ffab9a45fe4f72e5be5459c0442e99107293a7c6f2412c71f668242c5e5a502124bc57cbf3b6ad8940cb3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
909d27e32cb9495a3e040705eae86c5f

SHA1
352a817dc87cbb289149d2bd3b747ddfcff56323

SHA256
8f80e20a37b3fb2bbcccfa2e133963d0cde3b822415f442033d306967b967268

SHA512
778e59836ff224028efa40f0c2ff69615a56393ffb47984b7002ea90cb1c97f2f7ad505f49919c4bcc7ea1216cb6cc2fbf9f584fa7a54fe1547c15038ea3fd7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c3e9007df6ef04838b85266f89f3167

SHA1
65aeda96b172ca7d5e6946f37a7527a804da1deb

SHA256
195fe3c42854145f8bec86b0847cd193f77b4354f93b68674e99499a5880f5f8

SHA512
158f536a97c896dc92eaebe1d6f70d0c767af620d750bb517551201526eda6fa838f7ccf550b65eb70e7e79bc386be7bb1b1f1eb8b50b6e87ceab69cbc655cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
225cdb5aecd69f8751264b582102a6ed

SHA1
abf8baca246231f46c807c25728788fcf052c61e

SHA256
0fa2b8bd5be1508c983fe2df18b821967a178c0bd4caec892600f4b24097f516

SHA512
5d6c95062f5273f653241aa1af41eb4d34ad93ab4f7f303e89529679cfab8d3f4aa3832be97e448772546e2425eebff184dbfbae305013f608bc763a507a04c3

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Filesize
53B

MD5
9a3ebdcebd9ed2a3e1ef64386d677254

SHA1
9eb7f262043bbbd269ee7741faf3f19ae931f52c

SHA256
5012c3e8710b93c91a22382044054179477999f24d02307be10918b110430541

SHA512
c36cb9c24a0918b7c2e037d4bf96aa666f15f30c5c98f7f590cc3826764af8be3ec3166d9c8cc1fb3067c79592a7f5676e2875bb921e5c2e5b6cf0ee280d4113

Download Submit