hxxps://vaultcord[.]com

Analysis

max time kernel
81s
max time network
90s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/09/2024, 16:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://vaultcord.com

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 3 IoCs

Web Service

T1102

flow	ioc
2	discord.com
33	discord.com
34	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3761892313-3378554128-2287991803-1000\{40126E47-6816-4DD0-AAAD-8273C38A8A93}	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
2448	msedge.exe
2448	msedge.exe
276	msedge.exe
276	msedge.exe
3796	identity_helper.exe
3796	identity_helper.exe
4636	msedge.exe
4636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe
2448	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 1512	2448	msedge.exe	79
PID 2448 wrote to memory of 1512	2448	msedge.exe	79
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 4980	2448	msedge.exe	80
PID 2448 wrote to memory of 3028	2448	msedge.exe	81
PID 2448 wrote to memory of 3028	2448	msedge.exe	81
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82
PID 2448 wrote to memory of 3872	2448	msedge.exe	82

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://vaultcord.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffbec733cb8,0x7ffbec733cc8,0x7ffbec733cd8
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:276
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1992 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2468 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2976 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1920,10160863864791671702,5543744730211386320,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3972 /prefetch:1
  2⤵
  PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db1dacae9540e883ae83489b18cfc326

SHA1
ec3b68e635d8ce3bdafe258bca5187536d43065b

SHA256
3427a8a3b4868bd25a231ee8fe0ebada0b3474f2d8dc0fdd01a8931a8700a37f

SHA512
2e40df3bd1a045c69173f1a169b7080163de8f62a44d41d46c28f1643943657c532caa72f65b44a2175f976fdfd3d8328d989e011730aa851aecbcf02dde4a95

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04aa3f476e468ef3c0866e8dedd8f6e4

SHA1
1e9fa8fd586c03447a4c5b4cee261900e9f464ae

SHA256
87b74207d65f6745b38a19dce13336ee839fb4d7929fce446c3d1177aa80c42a

SHA512
7d860bbe9c847ea0b60f210860d865f1e936aa2210a6f9aa87e9fd72f992a022ecb9a1827212eb9b97dd7798540770f55c67362714d90d0bfd080ad1e5e7aaa8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
aaa4317957fb7ec574e6f02df72a7a46

SHA1
ffb93e161bd19f29e0c5b93b3f07989dcbb4251a

SHA256
1caa118ff15e64e4586ada8d59938e51caac68260c7f5806134309d08ec859fa

SHA512
17d6fbca11cf4a4c2e5810ff2e353a141e41661af7039b4c17cbd321999f54aaf800694e691349df88a7dcb5b2e0b6d7dcb16dd32d3f09b64b4bdfe280130286

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
936B

MD5
a0656bb8ef012b9dc9c932a833740571

SHA1
284b29b3ec59d20a9bce050db6914c35ac63cf39

SHA256
43a11926b6f8423967f2d85c374e80c699eafa32dd1d3821c3c9a5a0714577f8

SHA512
b8852fb4769f3ccbd7bb7302ee749afc2a28501894fe517c7c6be403aad66d0426cde9164f326b00b000110a187610e2928db705c00bc1f7c0a166ce3ec0f788

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c378a97ae8cff3c25aaaf1d406934418

SHA1
6b28dfa2ab220bb0e56fa1c6e48d6a68efb90882

SHA256
c9f11ad3077d5a71bbffe6e5d6ecee3c313d9476fd119ebb9ac1dd9fe99bec57

SHA512
3a13153394693b9240636d1580276454814096696f37e7340b0c1ec7212bec281f2cc8cc5b6b4e296256594bf38dc1802713367b4cf90cba69d34ef6538e14bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
feeb8e1aff4428652104ae63317df0f5

SHA1
53bfa1e6c58e1d0656f5ea8ff3ddcf38fed0fb1d

SHA256
9297409688b057a130587b8d8ae0b0a6929e29b0532e6b7dbdf40f6a55af2e57

SHA512
6d32f127292ab684f7bf72c972f920f52f1fa2db2baa1a7f05b66f60248fb90feaadf1e23fb5d23af1b65e063afae7016aa2df00696ef4b77475df8498411a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e427841de73058536a822be0e5dd465e

SHA1
a2816445fc76ac35c60fdf6f9a7805e56281b136

SHA256
9f306dcec5d8ab12b310d8706d5d6935e5d0c638a1dda033c5515cb9c00b7a74

SHA512
c8aaf3f94b0d70129bfd900af3c0bb8394015475edddd47365c607644cd2dc7c07c061f5de261574a59c53e10e8de11962c68b8036c18e18db1906a551547986

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c1e2681cd172a88ee566310f9aba171

SHA1
717447158b812f85551ec23c2c481a4f6154255c

SHA256
ac2b376f041c8b04a39319c725f79e8d83ad2019a1e6241b236cddcfc3dd4435

SHA512
f7e2594f30a6f90b59110768a01da0982f4aa1e562ce14ddd0f1adcfd14e7af022c570436010bc0518e0e7c8524e7a47d681dfec1484be68b13572884489c74a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
82b34430c23a88295b86dd511c9eaedc

SHA1
5e7a8ff1902c6b6ab659aff2887bd7c2e86de78f

SHA256
62751b0e235a24c2bdacde88a2744a314dd54ed492b4ae03ac3fb72eb2a675f5

SHA512
c84f31caa23278734c57a426fabfd9ea38c071fddcf0aeafbb45ede5c7887894831eaf5399306e202a5a14b3de79d5a92d869ee7013222a042f79b667d3cc0b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
25KB

MD5
a34680f8b1266e2832acacdd5974cb48

SHA1
8ed0a05cd9bb03b4990ba77cc79662cacb1e9700

SHA256
cebd372ccf5372c18ce3b746cd8dff2d0e01ec59542d1b3079887f9a8d1d1c21

SHA512
6e4739b7489525c9979dd92f7c480d9574b4215aa92f65edee6e5db9aaf555d9c0ba578d6b6ad92c839648060157967e97a16fdb9d66ce173db6f7c82dd8562d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
7ae9ac2f07142fe015174cf9214683b3

SHA1
b2460f1f5a86840dd248a44e3dede47dc8183f1d

SHA256
b09eae6debe7150e2ecc61a26d532a085f2481cea3673b7f07b9858453eedf40

SHA512
0650a7965bbc374d25ab2f26cc5a7d8b725a3a38ff8797604e99e70aa6bc05122bfde190e08020c57b19d6501e894755fd425896e7d67e95433c7413d23bdea6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
c4cafd85383e503c3fac876b72b499ab

SHA1
deaf8da3dd3bc3b42d7183c05600a730186e3e8e

SHA256
a5d9d90b482f2f5038c11590b17974d63b737b4ef6d3f7736bb47a6c33e1b65e

SHA512
05662b9b9ff57b69046abc734685c842718ad71a75aea8924c43feda0a1ab72df7723eab76bc1ece7eb20b2faf2c5f9f390dd9c8e1a8d7723f7da17826dde125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
875B

MD5
4c625a09de850ea5898cbdba7392cbaf

SHA1
ba10e0fbedc042a6995c4e97dc58e939c8e680b3

SHA256
dc24bf3baef9d460ac3fcd19f72f2ee59f819270f872561c96a26a3217801747

SHA512
075fdec6d7d86999b03b52eaaf07877b2736d6f2e1421ffd0ef1b4e02204c516dff0e8cdb9acf3d4ea029791f9eabafba907592ed0f1224fa1d570150bf3b77e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f03c.TMP

Filesize
372B

MD5
b3d16264ba94111c14ef3db0ecffd329

SHA1
4844512e85fe467a1497b205cee1896c70dbeb73

SHA256
64700af905ba24d0fb575991a1e17be31acf4c2c8799a63848588167930855cb

SHA512
e5ec3a6e2e4d757ed4db5e860151e6e8d48a024f17802e788dad503bc0813d6fb7e7f8544e4886aaf0dc20c974925c3e69413be46fc73d23d1ee8474ae047311

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
2108893acedb56360a4b521c7d1a379d

SHA1
cbf9e4e1b96e017230376bb247e9639f8f503bb0

SHA256
e84741911ef02b8283e1b749080917d501fdbb99233bd6d08038d6cc598d714e

SHA512
cdb4f9fa345a8eba4df4a4ce2e6536ec870c3189bd75c8417bb46f23d34992e47876fb1c98e4828bec8a5335a4521b12b7425b10dc80f29b9fab8ae992c7b88a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
769f2877df378587c1a21c4b159504cb

SHA1
7dcca4e31ff57fab12f4f99ebe135dd28a8ef875

SHA256
b1e09449d62de4516eaf08d1b6e7add764322a7b0da7cc31063404d553ff2ab9

SHA512
e0211b29b20450beeefde30ef16b2561b08bad89133608e8c5b57811b03d50c3f5d573a6fa869f770e5f4dea95393dc196f906e59d5be778244de0a211824219

Download Submit