hxxps://bubble[.]imaginaryone[.]top/

Analysis

max time kernel
80s
max time network
84s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 11:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bubble.imaginaryone.top/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1768	msedge.exe
1768	msedge.exe
5040	msedge.exe
5040	msedge.exe
2168	identity_helper.exe
2168	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	2900	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2900	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe
5040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5040 wrote to memory of 4332	5040	msedge.exe	83
PID 5040 wrote to memory of 4332	5040	msedge.exe	83
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 3732	5040	msedge.exe	84
PID 5040 wrote to memory of 1768	5040	msedge.exe	85
PID 5040 wrote to memory of 1768	5040	msedge.exe	85
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86
PID 5040 wrote to memory of 404	5040	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bubble.imaginaryone.top/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae36f46f8,0x7ffae36f4708,0x7ffae36f4718
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1964,4293433777407737884,5433423176366419981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3052

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4092

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x320 0x2fc
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
1024KB

MD5
7630ecd31db45311aa42801f3fb86b5c

SHA1
d90dab006e5b95d7b88c8a37e69072b411452a7e

SHA256
059d1274b77695efd192c6fc984a41e5c3fb975dacf83115bb05f5d3fc3ba806

SHA512
6d2b5978138d4eafa8f3ce0021ec08e2217384c99d8b1f198b6fa2c411c7589f6a2dbc05c7c2332639afa37daf2671d8c7587f31ff4c5a3f41ea789cecb472d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d

Filesize
1024KB

MD5
e81b493d3a38aa9c78dea64ebb10652a

SHA1
2895ae522c37c10bc83f2f23c7ca6828849f94ef

SHA256
3a32062685b5a8d809f81aec0b7a205dd2b6760d076431a242385ac22f29bc98

SHA512
91a418655f4d000907caf0d08f6eacc84599f5de73feb7c1ea1e3ab05ace42da1773889d6eeacffb89de8aa1c47524b16baad8cb031210c7f95a1cb33039d652

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001e

Filesize
1024KB

MD5
fb0321db76f857f67964e76618246aa0

SHA1
ba12996ac7afeeae03b2eba415bc44b2474be3aa

SHA256
ffbb240d361fd5cc887c0cd4b0593d43210cc5773d1b109d062a408b870e2d0e

SHA512
da236c6025805c55112b146451b0c19442c609a5ffb655717bfee8a658ccc5f2b3846bcb32156be091ca815321278df35c99a33e5a3c3b6be611e4b9a35f2a28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
1024KB

MD5
1d81c64615575b99f858aa1b94cf6e79

SHA1
03c3d1b14c754f07b2fcf5db09ee8834136fda0d

SHA256
93e0be7712663eb712f0ee4b35365ae41279d28c339fa9218f909b57b92f38db

SHA512
07d5f93a24fb7db8c32cd255228f792cb627e17fc1538a72caba247c960ea42b2ca9156f0de37ea5fddb52206a69020f3116e400e9ba72cd5f30fb4cae57a133

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000020

Filesize
1024KB

MD5
a69bc23be93fe30b1a49a97de60e6826

SHA1
edfffad51e41b8105ab1e130553a71e76966d425

SHA256
1ba9d3a7ccdef8da562332a1a6f74dbb50dd267062fcc0e3044da788a168a3a0

SHA512
0477c94fdecfa00b44da38ac0c53b7996f4e1420a2ca62b4b90cfee59183e61d11d3dc66f5c4b530e17101cdef9601f0db673a72c11bc8126bb2ce67c3c4a148

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000021

Filesize
1024KB

MD5
ef5c2b0b4cec86dda947e05d70b44675

SHA1
76b96f5152ac63823513cc52e5e0a3d1f10f9889

SHA256
a2fdbdce974421d9a2c0c6b492e2515ed1ca720164b219d3def84b37e53d0dd0

SHA512
e484b7342779e008bee377e4df088a73e83f4f1762b8a4c06206fefe50c8c3b5db54834a412671ebfb6effe1bd013caaeaab3717d8d2c82dd8a2e4baae1c13c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000024

Filesize
247KB

MD5
60ea6cd5399b0ecff12f76c941a8783a

SHA1
41906fbcfca078fa8faf89aa6c3a8c1ad42ff505

SHA256
1b600063a102d9178b368788b75445d1cf4d71870c71de855961fdc2f52a9e8f

SHA512
b38085eda341b26d6c79f514f79679d2ce01f432750edd25f1f066055a8521de394f50f59c491534ad783b378d8dbf62a6fc9b5639fcb7a63d6badfa4f3de1b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000028

Filesize
106KB

MD5
d88254a3ee6d1cee21fc0d80f24c3e94

SHA1
f78d856d3851e94699e6aaf9151e67cacfddb056

SHA256
66959849d8c5c22acdc2224efcd01f47503dbd834f437463493f6200d2f6f69f

SHA512
ae06fc097b9af434f3ff90d05b0b6b63c5bb32d4806c012f9d2d395c3c631b23e68348e755227ffd715edf719073700fbd221737a3cb57702c6580992c94dd28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b72b0b78be84c5aac9935c63682c2471

SHA1
08f8aa64feb286a244015d45ad06a103669aebf9

SHA256
d064d70b72ee64832710c1b3e83e072d991c41a1faa164b6568f82f89300a1ef

SHA512
ae42f84dfcf215dc24c44f1ebdd87b26e7eb660883b4442fdec4b647f50e8683d4167140fda8e23ffaa51f67337ffd84185dd4427992736dbbef0f55239323d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
265B

MD5
629592928278b5aa51e4d7cb05d40abd

SHA1
9e7801036b60739cc6bd95b73db369adf326cab0

SHA256
9e727af89aa38cbd08881f3dd0da9f2be335975de8db5b98469dc9a673ca6b12

SHA512
e4f46dcfea21ac57b59913218e4c60fe2b8013ffc70d3a7df0852d1d825bdd357136fb62b884614981c7285cd70bcac977005305ad77512837d1af1211fa3617

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7fe63f8d2785a4ad7ee42fed9d42d526

SHA1
a3d6fbf9a3107a9bbbf999b3bad550080aa9d710

SHA256
0f9b02978005783852ea0ecef19d8d3243bc09e49e853aa5e60b0c3d59dc322d

SHA512
61f52b32823341b56040da48ae0a88050da2e8556b645cfc3c1b8f01707cac592efb247531d27e4cc0d87a19f840f6dd15d245641121b813dacac6e17aa916c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c1b645a795bdd1a1e09c240daae5e25

SHA1
1c149af8e5984c3012d4650214acb0eef8d67ce1

SHA256
95666543fcf8feb1e50a581686d8b87bb0e792f259295b6dd3b3b6397b2da6e5

SHA512
8063ab32995097eee76c32ed6f757ea1540199d9456fed384358b50724f113397fa5c6ec2fdf88c687603044aa74b4e8b12b93635cd397a47a7ca0703fc73623

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ea305da0ffdfcf069830a10e05687ce6

SHA1
b227f4c1f5f9bfacf4e7b1a31653f4fb78967341

SHA256
bddf02094f7bb2f9471e06f75cafd65ae8332c42a746ff14c8f7fc7c10c6d177

SHA512
2180b8ebacf8c77b0d3fbd9812c6912860a25d22c388d68af4ee5df0c3a53ec4cd5c683efd55cb74d9e451352491a7b543afc65dcb9d202cb579aa1838e2313a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
42e92ed8f35358852235ce0ecec66a2f

SHA1
fa314175fa83a5e2faca3b47d4d4176ffd03dcfc

SHA256
82ea82ff37daffd9fe49949e9b7c1765927ebb8c9c9c52c344eb6fed5496c1ad

SHA512
58d158ca9d3e4ca6ffaabdeec9d9a991b4e27f25e4d5e8b373532c2fba1efcfdde3038a6ce9fc6e27951ea2adda3c3ed11cc94a83799a57446ce562cfe240c1f

Download Submit