hxxps://u3iy9j[.]fe60[.]fdske[.]com/e/c/01j8kktj0rsajr84j6pr8dm783/01j8kktj0rsajr84j6pvnq03pg

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 16:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u3iy9j.fe60.fdske.com/e/c/01j8kktj0rsajr84j6pr8dm783/01j8kktj0rsajr84j6pvnq03pg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
5108	msedge.exe
5108	msedge.exe
4780	identity_helper.exe
4780	identity_helper.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe
3956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe
5108	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5108 wrote to memory of 3344	5108	msedge.exe	82
PID 5108 wrote to memory of 3344	5108	msedge.exe	82
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 2896	5108	msedge.exe	83
PID 5108 wrote to memory of 548	5108	msedge.exe	84
PID 5108 wrote to memory of 548	5108	msedge.exe	84
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85
PID 5108 wrote to memory of 1352	5108	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u3iy9j.fe60.fdske.com/e/c/01j8kktj0rsajr84j6pr8dm783/01j8kktj0rsajr84j6pvnq03pg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffccaf746f8,0x7ffccaf74708,0x7ffccaf74718
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:5132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:5672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,6078995341006009446,14445330078054487918,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74757b32-3cdf-4ea4-b66b-fab867421825.tmp

Filesize
1KB

MD5
890d5c49e9a0c5a020b73700d2c215ea

SHA1
f7aa14afaa725f36460b7bc1426c1fc4764811ed

SHA256
02154c9cfdfef1eebb6d11b983af72e9555d0225effa4c6d3d9078c0f4cb3787

SHA512
b4bcba3e2a0b37052f0aead4256154ce0917fc92dc5fe3d0f2136eef22c96c88684d2bba17c355ddd14a7684135cdfe6851495d92ea6e513511a5b5d748274af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
a13264b3f2887bd4e024f8237a594183

SHA1
b6c7bfd954984d28aa8b2d851ad6a333b823b988

SHA256
2b8c3b9a13eef31db00c4590d5e7b548f7f6f7cc0cd4d8b14f1c49ee5808f291

SHA512
5a097acaf5d813f182469b42472e3cfacf0c6aea24335ace62da953972e893a96d86ec1fa15665a574ac8a7ffb0d25135daa440f89eb97df9eda67ae9cf9c7b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
5ddcea8ad832074e075c1ae010b8682b

SHA1
0243b102284ec99585f38394e44ad1f037ae3022

SHA256
13f87120829cc83614a877f06c72e8ff86c48e12e9c02554def7a9ff12e7d3ab

SHA512
e44909ae909ad471d76773a0b16a9bf0c80ffc449d905151280f95b9359328886e9ee91dc8388915629a76bc82758fa52b6a5fae5b8407de8bd49f92e620984c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f0b4fd85bff37a0bdfde81cadbec04f0

SHA1
5b4f52a97b4243afc32db0add447ddb0e938ff72

SHA256
2ba66acd0deafd5b1fcbc85011ed37cec03c812353c64a7a4998d158a5aac438

SHA512
ee7d3cd385dbad1ec1b1f5078e820d8c418bdcd589bd80e38121df2862b8b481d1779df952b0f656f8005924b279114145a9288dbbc096ede3d59ba78b8adfb6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
f845d8e024123d2b75c70fea7031b022

SHA1
c483304cbbe7ac96006185b47e9bc11efd7cb7d0

SHA256
f2837aec1c6ea8d16f48dee5fc999432f448a04b14ca75d76268c08a5663280a

SHA512
8ac2e659a1fbaac2145cc1178917590b5f948760245f103af0eb2a4afa372bb973b924498fda3c9fb312316c8a5bbc10002fc3578dec42466b67fa6be66066ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
30e2d23b1c39725a13ad8a58c2c22ff0

SHA1
0a1dfd3d881e11fd7226af044e43734216e1218b

SHA256
2a309d5156414dc042074b9f7e3cd4c0e816efa9567a08e5214f3d2629d1da2b

SHA512
a87d6c3558f334b3f626ec61c2dce6faf7f771d6817292a51f948ccb3fce723961c8879eab071a207837527d2f5710a8088b5f4f1ee113d96955160f201527af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7c2b8d33da673d19840efd4c7a2e3a24

SHA1
fa5f45276d530d2ae9c7234403cbe3c9e6302a88

SHA256
1b6b6839b9db46e86fcd06a592ff7d5001f7233071e212e72fa816b392d1e46e

SHA512
b85c99b7426152d2452fbeffc8c6e80b2507f4cc8fcc5dfba5f0998fe7cdcf695ea993b25e8870db1ff1e38ad6671f9b1cf0e8dfa968470cbf101b0dff983c26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bb9df9be376cfe80289e54d2667710dc

SHA1
0b16b73de86de0813f9eee5eb23fe7caa928456a

SHA256
797fdb24bf2ed028b2aca2dae412be86d857151bb074ced9b04650a25a75af36

SHA512
82e37de826041e21e7b02164bd71a626313667f9732fdddc38d311b6ff050e14172accfc26b669fa5e31309f4eb8ca16263c11a560d540c5edee581a84888a24

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
1b0d26cac93d5af48ae19f8d03443552

SHA1
76480bbb6b999b6280864f3b4cd802e0ea87571c

SHA256
7f86da37f0612b0a6bb6b7e501535b561904adddc5766b41d378188673f55223

SHA512
467bfdf7cc20816d6f567f9331d30ecd0a14208f1955b714434c7c45e5fa614f950865268f3b471432504deba3c41c65979034303aa2693e332e5eb4b6692dca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
872B

MD5
dd7a49401aa77b2ea20c9a18125e67c7

SHA1
2664385127493777568181fa2faad15728166bd1

SHA256
f5425271476b1a5e49b80c8d46e362baa873c0477ee6c71c3a1f7ef07ed9cf32

SHA512
959502eba183cacf6b8aef14efa05b9773400fc8e8b772717541d8fdd0c14cdf80797a0bbe7aacb39c9ff4c473e69edd2589b708603f82ba90f262c0b9cc7d26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580d1a.TMP

Filesize
872B

MD5
27e4bdf9cd6d2d43765d2e2cae2f8015

SHA1
756da74402d8c1e7180d4eb88a03413d8237b832

SHA256
0c94d246f7857ec8a429abc3bc4e574b83f994ab535d67cbdea3374f650cf2b6

SHA512
d231d85e8e1fdae2b8884bbc20b083889a0118f1117a59dad3a1939a8062ba766a682a2a5cd681275ac38136e0edde9b74202a0944095f74985ac89ea3783c61

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
690f03d2e4126ac4e48ed8b54041ad60

SHA1
d64d1c1f2610a49af27ac9a0837e2a658d0ff6c3

SHA256
427d31a5d9cebce6aaee75b81cc3832d4a03e0cef62427bcc20e5b187540a2c0

SHA512
3541f621a9130ea113b738b892a76d4f166ef06acd80eb0718b2ff37f01e40deed029896183a253e8e5febe5f0cea1607f2211b36382916b4e31b42563c24735

Download Submit