hxxp://vereares[.]ru

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://vereares.ru

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
812	msedge.exe
812	msedge.exe
1564	msedge.exe
1564	msedge.exe
3948	identity_helper.exe
3948	identity_helper.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 3560	1564	msedge.exe	82
PID 1564 wrote to memory of 3560	1564	msedge.exe	82
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 3512	1564	msedge.exe	83
PID 1564 wrote to memory of 812	1564	msedge.exe	84
PID 1564 wrote to memory of 812	1564	msedge.exe	84
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85
PID 1564 wrote to memory of 5032	1564	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vereares.ru
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd171146f8,0x7ffd17114708,0x7ffd17114718
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3088 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,12138608981210180106,14551974971331224234,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
70KB

MD5
4308671e9d218f479c8810d2c04ea6c6

SHA1
dd3686818bc62f93c6ab0190ed611031f97fdfcf

SHA256
5addbdd4fe74ff8afc4ca92f35eb60778af623e4f8b5911323ab58a9beed6a9a

SHA512
5936b6465140968acb7ad7f7486c50980081482766002c35d493f0bdd1cc648712eebf30225b6b7e29f6f3123458451d71e62d9328f7e0d9889028bff66e2ad2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
62KB

MD5
c3c0eb5e044497577bec91b5970f6d30

SHA1
d833f81cf21f68d43ba64a6c28892945adc317a6

SHA256
eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb

SHA512
83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
41KB

MD5
3fa3fda65e1e29312e0a0eb8a939d0e8

SHA1
8d98d28790074ad68d2715d0c323e985b9f3240e

SHA256
ee5d25df51e5903841b499f56845b2860e848f9551bb1e9499d71b2719312c1b

SHA512
4e63a0659d891b55952b427444c243cb2cb6339de91e60eb133ca783499261e333eaf3d04fb24886c718b1a15b79e52f50ef9e3920d6cfa0b9e6185693372cac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
19KB

MD5
2e86a72f4e82614cd4842950d2e0a716

SHA1
d7b4ee0c9af735d098bff474632fc2c0113e0b9c

SHA256
c1334e604dbbffdf38e9e2f359938569afe25f7150d1c39c293469c1ee4f7b6f

SHA512
7a5fd3e3e89c5f8afca33b2d02e5440934e5186b9fa6367436e8d20ad42b211579225e73e3a685e5e763fa3f907fc4632b9425e8bd6d6f07c5c986b6556d47b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
63KB

MD5
710d7637cc7e21b62fd3efe6aba1fd27

SHA1
8645d6b137064c7b38e10c736724e17787db6cf3

SHA256
c0997474b99524325dfedb5c020436e7ea9f9c9a1a759ed6daf7bdd4890bdc2b

SHA512
19aa77bed3c441228789cf8f931ca6194cc8d4bc7bb85d892faf5eaeda67d22c8c3b066f8ceda8169177da95a1fe111bd3436ceeaf4c784bd2bf96617f4d0c44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
27KB

MD5
509d1e75f9876ecde056faafef5ae620

SHA1
2581fa11587d73ef6f611557954518ebb7908bc5

SHA256
b3b355f7ae6902d546436864f69c20e50ef07a43477109c5bd2afd5f0f06e954

SHA512
ad16b96f2f91ffdc12e08c1b86612bd9019ba6ea4dd2e1a2c98f586eaf27efafbcd5ca6e238a0ba7fd89a065c3bccb88d756837089e624133b2b33e67521ce7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e990122fe64783f4632d22662d8c495c

SHA1
fee2a98a388a54fc13f558412daa3f17eb4215dd

SHA256
0c54c2e05bd34496f15af149bbd6536294fd5a0cada614b0c3f4713a960a1e18

SHA512
f8a10e3ebf2a49b81039c5d9a79392687a90428c663d055aa537ed2449cc00fadc1454c759b7c8e602ce43b744bf4bc1988ff866099d4635762beb0378b9c156

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
5d0a11f2a7f7c22b22c8289a2cf30367

SHA1
a83ad17d8495f17983962f43f8f6c69baaeaf8c1

SHA256
18bd6a8c5303af622059ea5b84e1d40f12dc6c436dc269b17fb02cf69ef97c4f

SHA512
1b4338a633bb38d4d6d427e2303dc7a284a051f54b1da77b91f539f0b6a41b3a349dbb0b757e25cd244d916fc37ae7e81667829691695c6a9e62c8e70f0258ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
388B

MD5
dac97deae623f9b469e1ac393188b4fa

SHA1
e9ee3dd626b41aa0f9454e98129e0da30bb35a13

SHA256
5cafb9cc21e90e87ca549e666aab294aa263fa5df5e9845655d9e76264339427

SHA512
bbb781a550d3f5716a06c046bd2982488f67b787536497957d621029a4e1848e89965372c86ebe4bd620630636831212e715de445960cc1d4bafbde837d7ec07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
86689763263770dc5d542f8c9fad78bc

SHA1
53db7550ff91a4d48c784e69f4e7994df59185d6

SHA256
83f8b3d49484188e93822e6bc1df5fd6ec17c2d6f980418b76f25aa8254ef310

SHA512
0af1eb8018de80cb488d2a97f8b9765a20b4dde4eeccfdbc53c482179956cfa6dc3b4dc8f1a69c8a634249548c71352d702aa83f8c7e8b2a96f658b4d5ad5ddb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d4a095efb63adda563a4d305463e9f65

SHA1
36bd3cf6c97a33809ec50ea0988a66910816b4bb

SHA256
270ad826bcf2c46ef43da473d2ad1f92c16c1b68e51c3a52beb50c4a73e43e68

SHA512
717ca896662aeb0d74d5f75210d414e840cd0a9da507a344ffe610a3298745c2cd3f3d8e70bf12afced62196fe4dd8fa0b61fcbcca53cb78e8b0f43fd2c44d99

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2a6cb86336d12026409d939ee91974be

SHA1
17f74f2210dd514133f044beec42ed544957a435

SHA256
36ab7c5d1113982fd3a4ca50454e0000f10feded86f1b4290b11c223f3d8dda1

SHA512
c6f245da404ab159e6bc958d6890a94991c28d941eb3ce940d4cae471ae7bb6dd2526d357274271e61df42c381d86b4c34bbb090a66b9a75975587f966a6338e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7624b6fe91221a8e44710f4e3e1f420a

SHA1
c859ab2591e834afebfa82ca2723a545fca71aed

SHA256
9a6f697f6c2451e651f401290832d6cb4440a3eda86bf20b3c8c1b8bb4e3874e

SHA512
d6e58b08f772f1593bb734c17376a3ae796d2364bd050efed01dc85dd359abe4aff1e107b29461176fb864e917e6262dc64f340d5f9e36dc422e9f754d0ede85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
2eb15dd21f46a12e063a485d3ff21ee9

SHA1
79a28f03eab629a1d2556b7a9412a3fadc890b23

SHA256
53c927b9f5c348311e5899add750bc54daa96501b50e08994e37eb7646e5ae1b

SHA512
ff13d36d6a93aa7aa757290317f7827c1817481c2473302b2b2ddde0e0264cd2a1884ba12b589af7dcc12970b819ee44b72804f6f83af676741ba3d7fa11cf24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585937.TMP

Filesize
538B

MD5
058e6e1765fce8e3bec257199e67b116

SHA1
603fdafee6849873455ea1d1fa7782a27f6fef53

SHA256
ed4e21072e125fd6c75ece45b60a4f5b0a883072c6cb4fe5937bb30af645357a

SHA512
88c97de2425250990d5e5b3bf53bf7f929e256c73794e7e7ee70dab57375574e0e07d39c9fa7164ae2c02f33bd33409b808086987b386da0395e1124af2bcc78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c80b03bfa6b44c97313f7c67c3c8c258

SHA1
77e5190876e970a10945bf50a0bf9c40c91afea9

SHA256
7e3a42f2118ee8620c135e36edef8749077188ded655a83a279cf40b08c54995

SHA512
817918cfd492c4789cc038c1c6f9ebef8f322bad0fc4159466f912adbe03013668f4bd914eb32d22d224dc8dbe485479a3ff68f579a625206e3a4237e84c46e5

Download Submit