hxxp://bit[.]ly/Moö

Resubmissions

20-11-2024 19:24

241120-x4lazawndq 10

Analysis

max time kernel
312s
max time network
314s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
20-11-2024 19:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://bit.ly/Moö

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4372	msedge.exe
4372	msedge.exe
2112	identity_helper.exe
2112	identity_helper.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 15 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 5104	4372	msedge.exe	83
PID 4372 wrote to memory of 5104	4372	msedge.exe	83
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4824	4372	msedge.exe	84
PID 4372 wrote to memory of 4752	4372	msedge.exe	85
PID 4372 wrote to memory of 4752	4372	msedge.exe	85
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86
PID 4372 wrote to memory of 4064	4372	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument http://bit.ly/Moö
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa14dd46f8,0x7ffa14dd4708,0x7ffa14dd4718
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3232 /prefetch:8
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,3286624578989846456,16752305433107059267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:3132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
29KB

MD5
791e1c0522bfb130884b74d26a0022dd

SHA1
9028360c5e0e6b92e7193baa5d7269571f5b1cc8

SHA256
df5ccb51c87d37365312f29118131b4c227d4e118a02e08fa70a54f74fbf5219

SHA512
f231ff36c2f8d795950a29535a427f0b653b0a7a920e35ac51e6700fa0506a0b9592d70a96ce09cd52a65b65e395917a36c87417b287c9d8e8ef8a2cbc367642

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
193c4127c789a1e8b013fc9f7ec9b680

SHA1
993e48fa5873413b670e19fc5122af6154b632c5

SHA256
24bdad3ee61ef8ff92583851b4798a4fa953043654403af0bf52ed053fba31cc

SHA512
bea7a1049cd3e3db68a8feb6a1600176cde6d62e35b3ae6286d124a8e521b5782287a7319ca36dcc39c26d97a2778525f0ed9050dfab45e9c0e231d4658473b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
83516c57390672e0339169e68914a3ae

SHA1
6ee234ed40a8d1ef7cf2610dd5a02ea08cfc74ee

SHA256
92d89c70cc298dae596ff75a74102a0d59e50f5b9d8f1ad6e3edc8f8a4f2975d

SHA512
a237fe675f8f1d7423fec84e3b2a0e0a0a12db6877bda5c0956b8977bed456d4e33f9aca527064794cc20f61a9318e371f1ce7f3b181e497053df29713b4c9df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
6c99c3d69bfe848c63202123035e2f2e

SHA1
c5e1435a1a23084abe0e921681434ac30e24d80c

SHA256
5cf2779a6ad84d1e0509984779531214f6ef5a93babcf50e23553fe6fa3f40b3

SHA512
fcc6d9df4ee6076475235110499696647df8202f138fa10a5e711f023daac59fce3adf9700af58551a9e03a79595b8a58cf68ea53ead6063a3745fa172eb1789

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c46fe3a926ef98d51dc6613a28c38401

SHA1
36edf8d32e2259239722bfee842dc7741c43ee43

SHA256
596af42a296c924615878769d246a33b63745cf9dc85e8e0007ffdcc8666da24

SHA512
0db30aa1987d4f818d69aa879b7c9fd80f41103367ea47d5c9ccee779f7091d2f343fa573974f163e09bb4e381b473ca750cf2839ed013b22c6caec6975f3cd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
b458b3927e6db550cc9713d9bf349aad

SHA1
d0296073e79aefa2451bac81b6a44fbe13035af4

SHA256
ddd0e370c4ac393f05dc6087cf73656b4d76b5208052398c27c5861c1d5eb0bf

SHA512
141f8d8bf0a89ac7a0ff4c29f862e94c2242c2de07947f49abbc760e9dd0474c3f5854f6a982f8c5de4ee741c8d7139dfcea9bd88ea2d523cfbd8dc38376cfd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
82ca2772f4c83b971a8510964e36420f

SHA1
9034312952715df51e208cfa27695967a1d1dedb

SHA256
f2107aa7f7ca12cc6f4011a893a796b8a44521dc1e4052e7ccdeabd82751bb57

SHA512
ec05554602b62d9c264cf67626f2d372ac353afce1b9122c99a2f42a71a5774d1b3ed81d0e27b05358cac49c7b01299401652ad4794107aaad0866d689df42d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f16d1f1ac0f300e7d3d3c45bcb9fdb09

SHA1
a37bb3bffd9652c0d8a6520a3916d1d1c5bc708e

SHA256
8dfd9b084f5bb8a0332ca5c1ce6e867f584f005b32c7815bfbd529955f19ec42

SHA512
aef04fae26b267e9c60ce471920c91ec712a2e3f8507281d271ab4e9ec12c9eb0675e549fdcea0a7879f6841e40974e5d04420e63108bcafd063d2c1a988a608

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6baa8350002b6e288a5e3345e43561f4

SHA1
5041cd9b1e39c7b52a43790750ca4ca32ac3ff81

SHA256
ffb8ce3d6d49969ebe2ca6ca71c838cf2a171cf72677827afb69524860a3b797

SHA512
74b9d05d90f1a2914933006aa2e1dbb9c5ccfde502f681bce5e8ae5213e3833cd8ca66408c89f5e2df6a0fc006862c07a090f7cc9990694365d241ad939d5ad5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
204e9e8fe65411fed8184da13984b77e

SHA1
355e04366e067eefed8200c6ca2da43b8662bd64

SHA256
501f3f221afb5c893d3ca0cbcacb2ba74f7c7181547797d4d7bb53309044f7c4

SHA512
733a7b247bfc11b011abce30d83d05f83308701a24381132e872a65628291a920e7fdb74480973900a6f10523d5f05fbced3a16ac41259f30c2faf6cc2202235

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
72662cab315a3d1d57ab5b7ae3d4600d

SHA1
0b58e5d234138f07c26296a3eef3cab72101a91a

SHA256
385b58ce0a5570516eba9f316de37db87c38856433260de068d85ce6091ba6e3

SHA512
81ff0bc41048ef9346dd84eb4346fbc528b32fad4feb4ef5bf2b9472184cf1f4f968232723c59d5433ad55d56efcb5fd284e89313ea4d21cd8c34ecb24cc82de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
affed6ac65239dee2fe0c58edc50f08d

SHA1
83d92b578953c07a8a354aac8173d4795ab9066f

SHA256
3ca94f0fc28dba6301a176cedf91fef442746358132ac83db8132f265e66f96a

SHA512
428d9115a900550f900e56620832118a15ad307308560b205b3f0ced36d4b85340e80a9ccb6e82bcb9b73fb2a57fc51738ff65a5e112b879ed1d68332923f29a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\Database\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
7ae7a66f076d2e6bc773148f4c446ef2

SHA1
bf47d0fcc07540ec36a6be9289cd6c92483a0868

SHA256
e0af50550d4d25e6482c0dc4cc956cfec29b50b188731b3e1456740e4c884026

SHA512
afc35f42a8e47cd249cf998c2a624204b68a251d675c23b1b5885f180a64c62c6be82353a98c09bfed64ca91c76c7a807ddce7879a4d7089be8fe80cd5fa2bd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5a8713.TMP

Filesize
48B

MD5
ffbdbe520df435633ed5341cbd3bf8dd

SHA1
71a2c00882aa482015dc83c66396537f8527aa07

SHA256
b37d25162fd6bb219edb2c49cecb4d4ca74de83ac3a707e53138cb605bb475a2

SHA512
b93f50944ecb7111dad88ea4efc631fa169ddf1020e890d98dbb5537bdbd31274bf38d7550f50513c9cc4e5dcfc6a5426ef7e1d74bbe769959ee757266cf365f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
9dbb3e2d2a2416680caf7b84aa548f13

SHA1
8d48100715495c6a6b6acb8ec5943a63a1ebd354

SHA256
2544e2e0a975512b84796ca208ec9feec88696e0ec25bf68eebefda2fdff6637

SHA512
39c47a1e004a9e0bfc41607181f6568e1083415947468b405d6862500955c3a6b9aeec9b22204e9f440a29ef917e97cdd8f85afee72ba11c202887c7c9c83fdc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
b77a5877cd2d485e28c33dc4919ad1b1

SHA1
fff75f3879dd3aaeea1ef47def4a3e5a93ef4731

SHA256
1085675d45348b8dd47b9f8c6d8bf785a888e8ce61b774cd73ed33ca39b5ba47

SHA512
115bc7f5c13c618e151459722ab8feea45960c0f2c2378a83e0d85ff0c0469f427cebe073a87a05c2ee5ebe4cacb0885698b9a953a23feef78805309b6c773e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
4KB

MD5
40ed4a10e4e1e4706beda65c549c8b4e

SHA1
a4235060188f4ee8dad602bf3e9622c4dacff590

SHA256
833f89dcff31ae11f20669cf275324bc7694358036fe75597b464c5c5154e5c8

SHA512
d417777b7d9634cad21473363ea88163ac3aedac70baad782999772f172cbe5991676646a3e82f3e8ceeb8a2772a4e194c0d4462e55508979d129952a2071e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823df.TMP

Filesize
700B

MD5
8892ad26e9ec1354d76205addb560521

SHA1
f494af9bb7769947fc55dfed0ad057ecfa6a0448

SHA256
bb00b9c04edb5c58a6c40c1a8aedadf7d71308680865abb8ce125894ead6fb36

SHA512
e221241cc00c2eeeeb219b07399a0ce567412ee2b68667415c5cd6396aef2f895ab06e5a8ee110966bbb3ba0561b9489930a1f7ed9d3c7f435cbe48f9395e2cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3862e19ace244301a2ddb44541f5d3ba

SHA1
5adee8e46b7f3f838aaf787355e0371e8e5e3733

SHA256
8e875325f745fcbc24ab472c3aec8a1dfc138eaad5db30c711421f518e008f7b

SHA512
554ece6aa1af3d5a0b5f54fbb81e5f849a5d770ebaec579e349f7bfac70bd4ee27ec94374446a54155e6cebdc2b782f21b4ca4cbfd1968ad905dec06c543c8b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
d31ba4155826b9af1c6129ad864f6336

SHA1
c59b33647e28f33421086f4edec7bb3a957c7b10

SHA256
76d54ff0ab2941c93f87f766995d879a2c39d404d102fe2dd74c99a86cfecdb1

SHA512
8749793422b7010dd62fe7d2bed4d0c93943ec9fcb6b3836bcce526fc5d4956619aa06ee1e3fd06e66a2d282626c0159510e5853d7eb9d2c36b5e56e046011a0

Download Submit