hxxp://bing[.]com

Analysis

max time kernel
1192s
max time network
1161s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
27/09/2024, 18:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bing.com

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-970747758-134341002-3585657277-1000\{0B74DBE7-021D-4D7B-BF3D-C0969BEAC7FA}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1012	msedge.exe
1012	msedge.exe
8	msedge.exe
8	msedge.exe
1524	identity_helper.exe
1524	identity_helper.exe
5072	msedge.exe
5072	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe
5068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe
1012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1012 wrote to memory of 4436	1012	msedge.exe	77
PID 1012 wrote to memory of 4436	1012	msedge.exe	77
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 3792	1012	msedge.exe	78
PID 1012 wrote to memory of 1220	1012	msedge.exe	79
PID 1012 wrote to memory of 1220	1012	msedge.exe	79
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80
PID 1012 wrote to memory of 1356	1012	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://bing.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffb15bf3cb8,0x7ffb15bf3cc8,0x7ffb15bf3cd8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1964 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3832 /prefetch:8
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5644 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3436 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1952,5464694910897974635,8239417827924493361,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
64KB

MD5
2923c306256864061a11e426841fc44a

SHA1
d9bb657845d502acd69a15a66f9e667ce9b68351

SHA256
5bc3f12e012e1a39ac69afba923768b758089461ccea0b8391f682d91c0ed2fa

SHA512
f2614f699ac296ee1f81e32955c97d2c13177714dbd424e7f5f7de0d8869dd799d13c64929386ac9c942325456d26c4876a09341d17d7c9af4f80695d259cfea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
88KB

MD5
77e89b1c954303a8aa65ae10e18c1b51

SHA1
e2b15a0d930dcc11f0b38c95b1e68d1ca8334d73

SHA256
069a7cc0309c5d6fc99259d5d5a8e41926996bbae11dc8631a7303a0c2d8c953

SHA512
5780d3532af970f3942eecf731a43f04b0d2bdb9c0f1a262dbd1c3980bcc82fe6d2126236ad33c48ea5434d376de2214d84a9a2ccec46a0671886fe0aa5e5597

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
910c674723765f8b6e3172fe9f69b7f2

SHA1
7c8cda666a6b8895134f56006cce305fe6d4e503

SHA256
7dafb5bfd7521ee4e2e0f95dafa18ed57de496b33f72845277c9fbb496aa6e4b

SHA512
1dcd291f66fa7cc91dcbf35eaa8af2315052e134578f2b7d60f6d5678f78b5810f706789e435b4fea17dae59b52852a8ebb4dc946077568540b3d4cde1f2ecb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
114eee83c0f11796ba86f51cdae27947

SHA1
ef89efec049df5982d5b0bc2ca0c511280550647

SHA256
f7fc540d9713d4fffbfd14983acd1cc82053d41dc4390761eaca0f3cf9d08764

SHA512
c556c3d2f4102ee5d83fae8811cf17b5f99dadf26a34eb1a470f7e6f950d3cfcfa3ee2de1f9e5a0f52798b2da89ed918810c419427387c5172179e397efdf6d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0b97b69492af04ce639424b0d88656df

SHA1
597920dcc8a1c3112f36a8ddb68c8512363d167e

SHA256
ed31f5adace368b689a651862054a15c55a1ad4a584550740ba507d3a6e0bdc4

SHA512
81dab22bd91484636af14f464b23e9322c1e37b4aaa1dcea8827b6e8475c82a3273b28d094953854625f9475265070588d42c605c1d204498876d1831dbd4a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
874B

MD5
f07640c28677d7d61a73696fbd9b7495

SHA1
f4fd0ec5e539b225d50b5d6ac245bbc2719ceaa0

SHA256
8a67a60933e26a60b91576c4728055a022d130e36b4e5a8f7cfd8b8d7c2a9546

SHA512
3842a6ac1d5606576a30cb1a2c50b576fd9c7b986fa884f0a7eb56859b73222d792ea6f81115316a66374a6df50b2833eb655d53e41df160e696d4a5974c3197

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
905B

MD5
baa4996e1777b1f61f3a8bc55a5a630f

SHA1
13ece8668aab50ad4cd4af890189d65a2d7393d9

SHA256
4867dcc823549bc8ed0b6d6a94873707f77516b05a86ec0fc43c27d12634ce0e

SHA512
4bd46801ed806de3a18a6142ae84837731f49c1d7b733720317a98763f5146f68588e4c27d4732146e938831dfe7c7fb0098afdfb5c09c51bba935408fecd042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
907B

MD5
c8661ca64c6b686e6f41b6e05a0ca1d4

SHA1
3374323e0a2aa47dfece546ad8346aa5efd1ad7b

SHA256
74186959a562d95c662d4eda68490f9d254c3307a0ece685e21ea3e4118545e2

SHA512
106d453dd62d506daedd86f204c2186c99e2ffc81854ab2d646b9723fd4db949abaaaf1a1da59671c863cdbeb9f787f5f4fe43edbb1b41cdf50b934993fe8556

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
905B

MD5
68f9642319368f8ae0de55a88b9f2330

SHA1
98997d6410c14dae35a4272f261d7367f3a7a2a8

SHA256
18fa4d059991e9c04b6ca7eb7b341be9512fa1d4323b8713c0057076411c0777

SHA512
4561ca1cbb82961dff8c5e8240a44a7560e80155a322035f3dfd9b8e394d7e46e36bc215ef73fb7944ae6fb4b6231ab137168091c1b3f947c0ca8eca26581f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
539B

MD5
0e0d835a1fec875565bf6181d79ed8e0

SHA1
9059a8193f3b4ac8c330fc87d9b4fa0d02c74283

SHA256
94f917455e58102003ab783213883012c6a043169b91887ed22cd60ec278cf88

SHA512
96fa1c9a0d42f48e4c408a88427f9523b75d43d60dad6cbe0452f59f288eb1397b407a7ae200b9f91b518be67997027e15049cbdea4721399e877dbbc02dd78f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
905B

MD5
29fdaeb7542405d01f082398679743d8

SHA1
b93262952357daf1f85c7484761d2170c76d6282

SHA256
1250ac8a9b81883e7758a56fca766e21c5ed2b5d067377f83536d225139ace56

SHA512
86cd007550e68630f2bd3be91d2ac0ab9a540259116bec95bf2a9d31af10d5f81c0bc67c983d5e9e4ba25ccd27be213e1947419850cfb6b46bbbbdc080ad43b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3ca804df74b1168d6fff46d8b5781a3b

SHA1
f1f0b500e47847e3df1a62a9671c44fc5d68dd1d

SHA256
402bb4a88ad7da3ee4354a3dde99466e91cd8e6e6a9c670674085d1943d2f4a9

SHA512
babd5d218e9775762ad44fd6063c19608ee09432ae0b74b29a4bbf24e7b3c2c9c7e21bd51191892426f4db036b21184f8d9f7a838bc2af783a97342edb10b145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3c7d2a920f62931cee356f4b923590b9

SHA1
88e09fa566c3d69ad603f17aee07f3e641e05fe5

SHA256
43dc177245be007f3997838ac55e6767e2d9f15dace23ed4497ba524562a3371

SHA512
7448d5cf450405bb453717db67232e63e1b66251e5b4df21f7f06b3c97438bdbe4ed15489e41bd4bc98fa4171a31bbc3f3730f6bac3205f6824878c47cb69a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d1d79c3e2e4d652f61913a07800adac8

SHA1
7adb8c69a9df1235aee32c61a3518a6d4422c85e

SHA256
05a98dcad1b57f495f3277b7a3aae701355df7ccb5263cb3e7df4cee603c251a

SHA512
14bb6d9f927b18abee280567df7ed0b4978f168552e804887ce98e25ff2a6f5e09ca12fe829771438c89bc11f8831255624f7a23d1fe54bedc8b1bbd8725a93a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9aaac0228b5284fe41f44007acb8431f

SHA1
94d382d1f075ae6e6653a95fc181c2637697aac3

SHA256
779acb3f1eb33ebaaf9893d9dbcf67fc0a9db50dafa744e08d5d39e9f3a660d7

SHA512
ec5983ce46bbfd6c332312b77659bd89084904cd9afc45b59775cf60a97e522f1e9b1f434c97cab3f45b977542ecd0b1eacd46a995b10b987c6112174002f5ae

Download Submit