8cea4adf5febfa9528d01259bf9b70afdb814ce8b41605b8c619a9738a9c9414

Resubmissions

20/11/2024, 03:46

241120-eb3ensznbt 3

20/11/2024, 03:44

241120-eas5lszdmh 3

20/11/2024, 03:41

241120-d852ds1ckm 3

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20/11/2024, 03:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

memreduct.exe
Size

302KB
MD5

fe8eb129610e454ad17b9d6ccbf1df8b
SHA1

28cfddbc7faf2e66aee0eec673c7eb7beab25510
SHA256

8cea4adf5febfa9528d01259bf9b70afdb814ce8b41605b8c619a9738a9c9414
SHA512

4aa488a5844eb65fe0f72d1ab325ba07a40fa0cae658bba38f59260c1467d5c902ae8bcd6d8e2f15a5c81139147155948f99a0e303ecca001f24a58d5c5de399
SSDEEP

6144:62uLW2PbSyXuF4a4gLZRE65J3EvgxxEvM:6hBTavRh5J8qxEvM

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
4676	msedge.exe
4676	msedge.exe
2476	identity_helper.exe
2476	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	436	memreduct.exe
Token: SeProfSingleProcessPrivilege	436	memreduct.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe

Suspicious use of SendNotifyMessage 64 IoCs

pid	Process
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe
436	memreduct.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4676 wrote to memory of 4940	4676	msedge.exe	98
PID 4676 wrote to memory of 4940	4676	msedge.exe	98
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4468	4676	msedge.exe	99
PID 4676 wrote to memory of 4644	4676	msedge.exe	100
PID 4676 wrote to memory of 4644	4676	msedge.exe	100
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101
PID 4676 wrote to memory of 4492	4676	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\memreduct.exe
"C:\Users\Admin\AppData\Local\Temp\memreduct.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7ffe0a8b46f8,0x7ffe0a8b4708,0x7ffe0a8b4718
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2612 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2598351374086422646,13694505617694018116,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
215KB

MD5
e579aca9a74ae76669750d8879e16bf3

SHA1
0b8f462b46ec2b2dbaa728bea79d611411bae752

SHA256
6e51c7866705bf0098febfaf05cf4652f96e69ac806c837bfb1199b6e21e6aaf

SHA512
df22f1dff74631bc14433499d1f61609de71e425410067fd08ec193d100b70d98672228906081c309a06bcba03c097ace885240a3ce71e0da4fdb8a022fc9640

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
2c243d8234510e8fc72d6366b9426341

SHA1
54def3f335a76dcff0b48dec3a813ef585618fc4

SHA256
fc55cb6437dc26156a20999b485c425e78f87ae5cab5819da0d6ebe8cf75ab03

SHA512
bd62c04d6b284827ced0157c72fbe28712149a0f6aa96434e18fd7f85f27d2bbe1ba91e2a7175f11604e0310776cf2aeac938e0f8ecca06cd064c6275504d5d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
760f017173859ca7d47d7800622ead30

SHA1
c98a34844a3ccdfd9ffad157676af2157981b4d1

SHA256
8cccb99aca337d66c529e1538055d5c57a1edb31fa3c06b2e1354e62392b1807

SHA512
cc9d31fe52c2a036d9196a4d1f1bde611e8f0f7541349297275e3f0d81717aa4ebcf3d2071fab587a097f05bcb693f189c01ce6a12b28630a65ba10e2e08f954

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ced3b28758b4d698e51cd92f9159110e

SHA1
a3d26ec0cb238e5dee6fce4e879885785c54120f

SHA256
1e2dc3d071c638d7cbcfc52fefcd601df6e05dc2ec289afb31753e6b98521d10

SHA512
82b5ad3ebea2c55c8c21d3ba62465c9825a554d5e9dba0d6caef28a8cad1e2b3b6ca73c8f994a224f50f0531a8ee17eb03b99d6fc38a2240a6f65f89cd5987bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3bad0a7d472cb7226066124ed0fda249

SHA1
5d821fc94f75299c970d505117cf4477006ecacd

SHA256
963fbcda37185f3829751da79f26a863e65e31091cb35df0346d1f754a645f33

SHA512
85e0107afbd8f44c72e9719d9b06a6ea26b972dcc1b20cb0d6a75665dec5b5955c38b7ebd8eff9ce3c2cf3e6f0728936fa3d640e895fa63d11b700b9dad1330c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
582ae1589a6f5f152d1c66a662a1cdf2

SHA1
c4c51b59e28c7d8646fdb878fe09dc4f5528fc85

SHA256
5cd4a25a775d5cea7f9ce6bffd84213d02627d5b7a1b24f769c0152cfb1df7d8

SHA512
ee4481303b0e0b4e99d0f18a260b46d1fe54510848b3e679da8c066b3a8e691802f8c8206c4da5afe4529fdec751c0f011f37f79975a35eddaa08ca96c788378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7b8adafeac3b648f3fab685d82593fa9

SHA1
6d59d327e3f31fb1ece0af66b0f70136bffbaaf9

SHA256
e74995e09b2db320b520c0ec206e77501afd2afed4182f90da3ae99011ef02f8

SHA512
08b6961027efbdcc2ad3e7d3d5baf8f791ffc66c1535cf511f71da6aed57f58019525665521cf72df9fe1293f2a34e2e9b490d880eddf70f53ae1082d386ed83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
62f14b78bb7220235a46f8805a34c6bb

SHA1
6d7a18e5439ac092defc914f93340e99662b19a0

SHA256
7836eccafc217c7826580387ae1c3fc536715bd1b9b7a746fbf6cbbbca9ce1b2

SHA512
37eabdf86b05fc89893ed80e2d4f6cc8d0c53ed2d8a920b3a526a2f756f05f54fad2816d7e5e54d70e3be737b30db8cdae7d039ef6f588b45285bde82516e97e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b58d0a2f85dd866b32d48d019eef9a1d

SHA1
1be5d107b16b4cec3ff52aa33d61b4195562fc5f

SHA256
6983f695b9739bf051eabdb6488f68e1bed3cad2c3c488424acfded402e25709

SHA512
217244e6da9ffaf9e93271b66924df1563ea15d0f8c2ed0e6b8b2d3f134814632813e30cf0387793b57eabd88767b0339555b3d17788bce23e5e22b1121938e0

Download Submit