hxxp://fools;[.]cck

Analysis

max time kernel
662s
max time network
652s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
15/09/2024, 09:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://fools;.cck

Score

9^/10

credential_access discovery spyware stealer

Malware Config

Signatures

Credentials from Password Stores: Credentials from Web Browsers 1 TTPs
Malicious Access or copy of Web Browser Credential store.
credential_access stealer

Credentials from Web Browsers
T1555.003
Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
1296	msedge.exe
1296	msedge.exe
2080	identity_helper.exe
2080	identity_helper.exe
2268	msedge.exe
2268	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe
1296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1296 wrote to memory of 4832	1296	msedge.exe	80
PID 1296 wrote to memory of 4832	1296	msedge.exe	80
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 5036	1296	msedge.exe	81
PID 1296 wrote to memory of 1400	1296	msedge.exe	82
PID 1296 wrote to memory of 1400	1296	msedge.exe	82
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83
PID 1296 wrote to memory of 4216	1296	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://fools;.cck
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb8fa23cb8,0x7ffb8fa23cc8,0x7ffb8fa23cd8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1912 /prefetch:2
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4580 /prefetch:1
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4556 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1904,12713812454781525656,17947553753871085512,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

C:\Windows\System32\cmd.exe
"C:\Windows\System32\cmd.exe"
1⤵
PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3e2612636cf368bc811fdc8db09e037d

SHA1
d69e34379f97e35083f4c4ea1249e6f1a5f51d56

SHA256
2eecaacf3f2582e202689a16b0ac1715c628d32f54261671cf67ba6abbf6c9f9

SHA512
b3cc3bf967d014f522e6811448c4792eed730e72547f83eb4974e832e958deb7e7f4c3ce8e0ed6f9c110525d0b12f7fe7ab80a914c2fe492e1f2d321ef47f96d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e8115549491cca16e7bfdfec9db7f89a

SHA1
d1eb5c8263cbe146cd88953bb9886c3aeb262742

SHA256
dfa9a8b54936607a5250bec0ed3e2a24f96f4929ca550115a91d0d5d68e4d08e

SHA512
851207c15de3531bd230baf02a8a96550b81649ccbdd44ad74875d97a700271ef96e8be6e1c95b2a0119561aee24729cb55c29eb0b3455473688ef9132ed7f54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_0

Filesize
44KB

MD5
d1f604157b0745a40453afb93a6caa42

SHA1
3d5d77429b03674ebb0ba34d925ba1b09310df5e

SHA256
468456974fd86b33647942820dce7284879acfab9e9e6eca008e1fdcf9006fb5

SHA512
0644ce93724a57dedd8aec208e5a038e323a1b9871d5046d58a87c60479626693e6c8f25b7c7f7b60fd35aac133d2e660ecbd8f8d579ad1fc6703ae117a485a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\data_1

Filesize
264KB

MD5
262c334f910dd4895ab567ccbd3f6659

SHA1
d87c29ee1ca91aac2774bcffc123e35b2dab0e7a

SHA256
6b277491906ad507d4e12a68d66f706357d46932eebf30e16c27e92b8abd12b1

SHA512
49e286b5c1cf6a3a5624f3414d5d098b8975ba9f2fe400568d51d0d073918c5d2010b93ea37ab8a23085aea20dffd18a86f378f0bcb0d25a85e65df607e3cfb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\GPUCache\data_1

Filesize
264KB

MD5
6cdeb0aa642d170d569dbf6bbd6b87af

SHA1
575f414521325b29ab9db432a0027d086b09bae6

SHA256
ceb541d654384a74262addc6e5fac51fc57d1c65da523a5af395423bc197c1c5

SHA512
20391ccee4c4a0ccd2638eedb145773aa81584cf777c41519a535a4f455696e07c568d6d8edf85aea9a226a6084f13be197dd0ef6fc42d78956de86b9b2bef56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
635fc7b3c99afb2a081223ca48943463

SHA1
9f51d8c71117c5ba1714ab5561662583e3df10de

SHA256
c5016e9d48dc9559cfa7c55a785c63805ae527d6b11b5e4d621337b242c1f2ea

SHA512
66095f1f42581c03559c8a1d9fff1e36e028248587dba01798b5b8b815e39dc5538bcbcbfabdf2ef3df4c06291fe292126b705a0d5b7e94697a3166a32b2fa23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
04eaa2c44a9b1606f6a5c409bf5d1f50

SHA1
2e60da7e9f2c132576354b2528ab3f3ba431028a

SHA256
82b1611ff69bde03410fe22252c0a971aeaf71768d22595257fc6526ebb7eb78

SHA512
499774146c1ce340471b6064c96674222df5f03208ddf9730990271b2644d779d7ba935bc8d205357cb2eb6d2e0360c2b480d59dc252bf7e5fc297b326f8a67e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
80af59fe010142c0f1a4ac9e6305fc68

SHA1
5dd479f46f6d89062e043d925636c12b471b8dec

SHA256
c7b73d85492285f5cf3de5aea37cc2cc81456fe8821bce7deec23545b093272f

SHA512
3f0ff855b5a4e39cbffb28266464f952efac008bf14d9b426fa06c06c6d11bde7583d02bca820f30931daccb4db486918225a640cf97dad66546a4f61c9eb1bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\PreferredApps

Filesize
33B

MD5
2b432fef211c69c745aca86de4f8e4ab

SHA1
4b92da8d4c0188cf2409500adcd2200444a82fcc

SHA256
42b55d126d1e640b1ed7a6bdcb9a46c81df461fa7e131f4f8c7108c2c61c14de

SHA512
948502de4dc89a7e9d2e1660451fcd0f44fd3816072924a44f145d821d0363233cc92a377dba3a0a9f849e3c17b1893070025c369c8120083a622d025fe1eacf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_0

Filesize
44KB

MD5
5a8f6268873313e10d5c97747b9d94e8

SHA1
c1bbcb54d039dd2bd995d48353a81008314d3d94

SHA256
3c348515bf071653600a797fa473e58ffc97b8d6c88d4136fe5f921c7b6b15e5

SHA512
d6d6a939f7c482f573443cae90aa4c9cab17a2f925d9179b1294270276c37a48dab785be37c14fe1da67a22ca0eb20442b781e21a72925df6a5eebcfff2c6e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_1

Filesize
264KB

MD5
d786ed4f0e60af6d2d8585df54a8c174

SHA1
fdc7c84c37e833919b840eaf89d6253b47316139

SHA256
3a31629577a13c6300e2a077511cb81811d7edba0373556c617fab23a8237fed

SHA512
e4277fa1b9b38256d32061da67f6545ffece3e03fdfc8f1cfafd84162c21f6f503e73f6b8b6129b34067f0bcb3ea75b9ed88b4b63be5b32c73c4ae0953f67103

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\data_3

Filesize
4.0MB

MD5
6a8eb656a111c40fb30c076297c9ff90

SHA1
f8778bbf2c9bb51a8cf60a908e0c30e5b50a2a71

SHA256
0b7ffb7e415579ed27e3920f3173a4063be4f1315521c48c213a22597cead9b4

SHA512
c3abdd7c17c0f10508fe00fd04214456076eb523605254b00a07d594454c173c16e61805b315e3cf5010cad216ce85624ad8daafd2e919744bbc314235473491

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\GrShaderCache\GPUCache\f_000001

Filesize
20KB

MD5
ef9588ca82f853399e5968af99985e74

SHA1
80d9df4f75c3e789ddf10584d9ff9de2b6154cb0

SHA256
9d550015f47a4d5d502f8a2f5b33bd9cbd136f4fea7c64754c8cc5a9651f7fe5

SHA512
a77b6b0bcea459ab4fc1e5d0983e85b86a6b0835849345f6afbfb27a5e84d8d1a38ff16e21ecf862e95d0a74e3fe97fda28bea66752b8bd64fd44c8ba680a5c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Browser

Filesize
120B

MD5
a397e5983d4a1619e36143b4d804b870

SHA1
aa135a8cc2469cfd1ef2d7955f027d95be5dfbd4

SHA256
9c70f766d3b84fc2bb298efa37cc9191f28bec336329cc11468cfadbc3b137f4

SHA512
4159ea654152d2810c95648694dd71957c84ea825fcca87b36f7e3282a72b30ef741805c610c5fa847ca186e34bde9c289aaa7b6931c5b257f1d11255cd2a816

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Last Version

Filesize
11B

MD5
b29bcf9cd0e55f93000b4bb265a9810b

SHA1
e662b8c98bd5eced29495dbe2a8f1930e3f714b8

SHA256
f53ab2877a33ef4dbde62f23f0cbfb572924a80a3921f47fc080d680107064b4

SHA512
e15f515e4177d38d6bb83a939a0a8f901ce64dffe45e635063161497d527fbddaf2b1261195fde90b72b4c3e64ac0a0500003faceffcc749471733c9e83eb011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
09734ea3f097a5b4bc98cc4d5da906ab

SHA1
1b55523cd2f96af7060923ce6041395a8c19549d

SHA256
a75b9aac84eb60258cdf51c6cca38e7ae1960a4ad2c3eabea6176b3e9c3a4063

SHA512
5d6257d45b5811c98c4184ea46084c7cdfffbd0d6103ae0f3ce3f29245f923d1bcdf78cfbf2311f145465f5c4a5e95337ebfcaf5073eeb004b518d7a75da9b32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9824f9472a8154185754d888ac93f39e

SHA1
c771a3b11b5e47b67b19c75724102b275e89636f

SHA256
1327f5404e769c6cc5d1266cf214f4bf894ec4266c0c92551a21552b5d9b0181

SHA512
e1a141630e83ccf684e2fd8875ea51c32b31ffdcf182ca3ca265ba5f03e7eb498d58129c58fa6b0358a60698f2491d90b3ab26608cc2c72869d5b7586277a303

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a4945b0dafe482cc98a1cd8997673f72

SHA1
601ec18c552f4a8669e43190b1f25f44c7cd487e

SHA256
02a7386ac3322c1791292a3c783283794fe3b9df5d702c0560d75d53154ca7fe

SHA512
cc4711e2b8e29b126e08c5e077156d4e5c4207aa2f3b75072cda504b20a008f50d4a4ac64b966796e7d9b14b5ef6ebd89ecf8c2df048f4f0d8721c0eac220800

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ShaderCache\GPUCache\data_1

Filesize
264KB

MD5
ec66ff3351d2e686c882d0b93bad013d

SHA1
352d8b4db6b8458748ba77080abe855069dbd7fa

SHA256
943e3f9e0aa975da12812a074262771ac36f6839b5d2b131fc0c294cfa240be8

SHA512
d0947e30ad340c279c894f6153f7a1abd9b193564512280b5ddae3aeda8cb5c64ecffc74529a4b6a63d58c9dfcd9f9769255e9982de4ee1b2eed549abe7bc5bc

Download Submit
C:\Users\Admin\AppData\Local\Temp\.ses

Filesize
53B

MD5
2d09d70e1e6ac6c580a6e4c559834696

SHA1
a0110ee88c0d4a9c0a4f540f50e38cdb522f9142

SHA256
9d7ca91ea89f65247c05d625269bc359c96a42cc8ec599f7fe162e581a268d40

SHA512
e5148716da51fa0104ceb98c0690925093a7abd11d49e67dcd4bf210bc518a9956628bf8694d0068dafb8eccd70c75bce8b45d88538d22fc26d8b65b0350f8ad

Download Submit