hxxps://theoggroup-my[.]sharepoint[.]com/[:]u[:]/g/personal/rohit_theoggroup_co/EW1S6u7eBPZAkl8sn76CFW4B9_fhjfgaN299JnYAgaQ9MQ?e=CXhREy

Resubmissions

28/11/2024, 12:17

241128-pf5eyasqfr 3

27/11/2024, 17:40

241127-v82seazkgq 5

27/11/2024, 13:13

241127-qgh4rsvlc1 3

27/11/2024, 01:47

241127-b7271azqgs 5

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
27/11/2024, 13:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://theoggroup-my.sharepoint.com/:u:/g/personal/rohit_theoggroup_co/EW1S6u7eBPZAkl8sn76CFW4B9_fhjfgaN299JnYAgaQ9MQ?e=CXhREy

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1772	msedge.exe
1772	msedge.exe
436	msedge.exe
436	msedge.exe
3252	identity_helper.exe
3252	identity_helper.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe
2392	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe
436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 436 wrote to memory of 2396	436	msedge.exe	82
PID 436 wrote to memory of 2396	436	msedge.exe	82
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 4900	436	msedge.exe	83
PID 436 wrote to memory of 1772	436	msedge.exe	84
PID 436 wrote to memory of 1772	436	msedge.exe	84
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85
PID 436 wrote to memory of 1752	436	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://theoggroup-my.sharepoint.com/:u:/g/personal/rohit_theoggroup_co/EW1S6u7eBPZAkl8sn76CFW4B9_fhjfgaN299JnYAgaQ9MQ?e=CXhREy
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafe1146f8,0x7ffafe114708,0x7ffafe114718
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,10231311768947846165,12282540464748931318,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000001

Filesize
46KB

MD5
58833d086fced5c33f4ff8c828fe66d1

SHA1
cf554e2f75987fb7b2b4557d4b00abaf35646a45

SHA256
4c7b0ff624ef68bdc049410ba9b7d7e73ea81be39018a44e9c656667c8b328a1

SHA512
ba53054a6e21b44bb849d14d447ea191ce1f0f24a245fd3cd48f2880249010b59f70927b8b7139973ab25dee8d3ad71490bf2dcba53675a7a149e0ec5849ed6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
44KB

MD5
e5354da431f6a34b01ef85ceeb4f3f4c

SHA1
5465c2892adea2d1cdd88eb38f15b3172a66c978

SHA256
6a2ee7d54c92e4bce9310d9797aa51fdfd2b967e9c4c7c1096e9b1be0598fda3

SHA512
7c2a1650d700d6096f9a00daf159185ca6f22b477613d54a1ca7c9018db12771579d7e19bfccb265b2a742fea17928e4762088615c99089e7d73b36e471b585c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
19KB

MD5
31a2c91a8b6c9b2f6998d01f88380e4b

SHA1
5826d59fb15fe4f377f90a75de7ba3783a1d49a2

SHA256
4dc18bfcccd5cbcd52b3ad7cb9014ed8a73f8e887e0e9237b6cda583d9637f11

SHA512
ad883423c8fe37a8b49b38e0be6ef33571c4d3da3c0edcd672d7b8e5f5ef10e16f783b21a10aef8716e257a6b3a48c3298d2d7b787a89fe971f805c2333a25b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
11a0cd84dc831a7cafc8819cf129c13a

SHA1
ea15bf9cb4fbd7b3feb58285d279c03258bb5b48

SHA256
6a5f6735d008aa96b5cce0921e256895aa44ec5c66f8ece6da74db13f22e8c0d

SHA512
0256edbd3bd13e7230046ea593de107a71f02e1c353bdeabe588da3a6334b4d5e83e27ea99b445af9e13d1691d22e070798dcd6ec923c77b61c9e8fc0e7a1b17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e549a7593ac9008e9d56df71f9c7d6ea

SHA1
ea653a375e5ceb69028cf46c1531b6dcdee93750

SHA256
6b1019374cc3616f36ae92b8dbe3e447360e91c959d1c75259dd68e2602d9e3f

SHA512
dcf00ed3c39fc441e7fa29196d17d285c0a71a91c8139a5fb522903aada771751fe715604b4f9adcbeba8c3f5ba1dc145acc5df179f066ff7f5d2bf68975c14e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
960B

MD5
647f6bf21835e909588993dcf847fd7e

SHA1
5bc16c02c516cd3e81df3af0b537708763304fa3

SHA256
879d162d82c8e7084c1a0171e81e6d2f5d2bfeb7434f22f627a6b56df004a83e

SHA512
31113851fe063f461d7612fae0e0ec9da87d95d746ddc7a50a34f28ecc1b86468f3b7a29fbb51f862ca6e39db0f365a2752fb255cf21998c8057d91f96f1860f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b9dc9fe200c497ff62bbe18b23f58ad9

SHA1
0702a240c61cd586b72b05b50b5ce995c52693c6

SHA256
021d6f027797534460f3cfeb2698ea6ef7465a4e59dc0178d45ec66d0ea3b672

SHA512
9c36e39a3bf2c9a1544c2a16e67204a9673d559a5ac4131f3c85c07afbe366eda63a662d60e3b859839a3e1baf6c1c9ca1844343ce2b2dfd712bec2a284d3647

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f37128a68d0b183d57e8f34857a66bb3

SHA1
e54578d21f6d3c09ec08922b022845f65a941600

SHA256
25211deea30179abb6c519b19dbbf05033bd1e7bc5f74e2beb2be2819c4c3534

SHA512
ec1d901d22ef11f4fa5f687d042a068121e86c62ca4db3c9bc6e9fc5843f700b78afc7343de151632c4b4a548cae265fcfaa7b36bd53196740456d1f77af84c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
59da14d44945c6acab25aaf7f2e56cd4

SHA1
a1a60beec66aa83a1a2afb5ec6c894bc768768cf

SHA256
ba315cf2fa363a4709340c956de8da45d569a918fbac6cc9a9aa6cb8a47fe845

SHA512
16ec2de99f0f2ee91c4c58e6720ebfb1e2529e2981d3517c80a563f1f80d159968dba5c0c6abf3b76df62f69498eafa00d3f58ca397652ac9039b045719e68d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c66e050163a5d7b09c69178a9d7d83f9

SHA1
01d7495798493ffd14f2ce895c1b0a4f742a41bd

SHA256
f6f43f252f2736ee5f9e350ee3a6a9825b041bab50cf16df2cb2e410456a2d83

SHA512
a49c1f4a46a340fd6974204b011851eebc637f1978a58d623d9bebad3e355b7b39c4a7b4c8ad4220a570ad1c552298fdb5c6a5ff42a5e7f23125fd0d6cdbb452

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
67adcf501ae93740d8c7d592294e1668

SHA1
455fe80e49bed2816adc4f190a4d080089ce9dd3

SHA256
07e601bd659db485be6fb346de4a606427e7289de74493c05b8ca36417bf2a85

SHA512
f864716428e9cd3235ffaec46a03db1da2ff554bcb325890181526dd5d297b4b60dc702ce6ca4ba07cacb533fe17d4ed47fc8d1276ea6dcabe3128eca7d57e02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
916440b98e653f06a4786cc90a9e5702

SHA1
9e295ef93e2043bff37e66abdcda3e8ecab61e74

SHA256
3be8b98f92694941a91b58cf22aa94b543ab29104f05e01f35c7b9a694f1ffe1

SHA512
4fb9b982b759411453011056d1225f73b065245dd6e0dcbf26b75947f6c3bbc3ea160501c838e27179fcf5bf4d507dd0f4516bc524d83fc385c5c15f6d56ce0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
7633e65a561459707ff603a50c798171

SHA1
fb36e417547df61c4dbf5d871671b8f7b8d211d8

SHA256
b4e9aae874be6dfd77846415ab7e05cc801e5efea3743484062cb4b6372b0b28

SHA512
adc995aa405769696b2273defd49e1faf10fc1cd653db595f8b6f9e758e0f4a52f082353e00d76eca60825c4c75aff8169b7ff024e2900de347d4ce73ac4537b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
542d927079458209b812d02955d2a9c3

SHA1
5591f91ed129786097f24cd3a697940c71f7d461

SHA256
2b4dcfcc69cec7eb65c052fd5b5cc2e345b6b4d8446e91cbc48b71cbfb5c715e

SHA512
629b5c9d1e52f5771ec148f8735590e7fb0ffe4e80e02ad37e6502699c6faf57351d26b95adfd794c1e70fa9590ae4125c7d922b101325ef6561a39e4aadad05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
8d248f625dea344838e824a16ca6405f

SHA1
e1f21ab1007ec4f778b982f20e1725289b8e80ed

SHA256
8fdb85b30f53c57035d7eb4d4a54150a3439c1fe8943ef57fbb45b2933207199

SHA512
f7d341a4561281bedcfc7d041027b820956f4cc777f6f530710c081ea3d933e58ffd63fbb066e996f459fdfc27d1842652f5d3135a91d78fe6f0fd1315183ae6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
2KB

MD5
2fb309bc7d39f2b07c9257a4d21eac9b

SHA1
7d29ea9c9b7c17a7f578e82b7f9153d9f57d36a6

SHA256
dd3a94f08949c2a066f4dafd3dceb6ad63917189fa093a267b1edc0bb3d7d63b

SHA512
d6ef0437e9e138aa65cd432a130ab5736a87a786f9622744652e8333fee2c8141a913a4d9d506fdb8e710fe2e90e8c9be50362b113da8da534092ec41cd01ca1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b2a6.TMP

Filesize
2KB

MD5
190ed414936f823b580cb91ceffa9aad

SHA1
bcc4ae71c1e8a23793d2c76e6698d7c62107c326

SHA256
209615c7586c8c693595fc08b3150b4c18cc6c189b7a0c5db9ee68a49d1bd9bb

SHA512
576b7ca653643ef832863675c59e00952975f20c175021dc08efc127b89f821c7f987d13b6bfb4a0c30164f1d5b2a97eb69d9efe8f0c0fa6670cf9aff99e0016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e6c556c5-9dcf-4cf1-8642-23d1580b9f57.tmp

Filesize
2KB

MD5
4a540d6b9602478933220b472e06ab57

SHA1
a00b8c951f15625e3994a3e41aade29af9218f15

SHA256
23d9c9114b9908acc8ee814ca0a5b7f48393677b42af8ac9908ec7ba814e5310

SHA512
182e5a3bbd9ad023f5344c8e40ba84d15a5cee50b21e0efe717ecbb9162517d675c22ed58211f157e9c675fff34d2ae3967579c3c2d6adee0d41e9ce1271f064

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d899303556a378dd6601e5f7ef75efc1

SHA1
7e514ca13d183dcfaa771d96534994f085dc8281

SHA256
ad55e4a8eeed3be5f9e6d7583a9c2b23ec1a5422b8f56bcddb07375655beddf6

SHA512
94e82326b61146a771054d275fe5b32fc2f8fd189f99fa54e3b63340b3aedfba1999dd185abd07bc8792c6ff537c1d7647c97464517d585c8b34ca21b5b89cc3

Download Submit