c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a

Resubmissions

03/12/2024, 16:06

241203-tj58vsxqfp 3

03/12/2024, 15:57

241203-tecezsska1 7

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
03/12/2024, 16:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

winrar-x64-701.exe
Size

3.8MB
MD5

46c17c999744470b689331f41eab7df1
SHA1

b8a63127df6a87d333061c622220d6d70ed80f7c
SHA256

c5b5def1c8882b702b6b25cbd94461c737bc151366d2d9eba5006c04886bfc9a
SHA512

4b02a3e85b699f62df1b4fe752c4dee08cfabc9b8bb316bc39b854bd5187fc602943a95788ec680c7d3dc2c26ad882e69c0740294bd6cb3b32cdcd165a9441b6
SSDEEP

98304:6NRBOBfKgQIm9EOTqw8vjh9Ac9nUNupK4hVvcF+yHrAr:sR/gmeOqv7Ac9F0kB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
4344	msedge.exe
4344	msedge.exe
4080	identity_helper.exe
4080	identity_helper.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe
6064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4548	winrar-x64-701.exe
4548	winrar-x64-701.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4344 wrote to memory of 1628	4344	msedge.exe	90
PID 4344 wrote to memory of 1628	4344	msedge.exe	90
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 4508	4344	msedge.exe	91
PID 4344 wrote to memory of 2640	4344	msedge.exe	92
PID 4344 wrote to memory of 2640	4344	msedge.exe	92
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93
PID 4344 wrote to memory of 1280	4344	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe
"C:\Users\Admin\AppData\Local\Temp\winrar-x64-701.exe"
1⤵
- Suspicious use of SetWindowsHookEx
PID:4548

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff999046f8,0x7fff99904708,0x7fff99904718
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  PID:5420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3676 /prefetch:8
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,81145579741561400,15930469967101553803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e2a94df7ce0d4c109f01412d3c6be2ba

SHA1
af2f2f1cc245309a5040d31f48c73d8fee8beae3

SHA256
4a81db5d672f4a8f07d19b9d91443dc9f5ff573d40f6e4bbc650f1c249e9aac2

SHA512
d6785ba3f18a2a4fe2c5f99ab5722ea8316b33c49e62c206d2ea31d09c072d115d3a81d7d10137f2c9fd7a56f26678fb9cbbc623bc8fc087ae3169a8320af182

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
e14300f1c1d5fcef318202fac7c87227

SHA1
c0bd29445759694b513861ee44d706bf7bc96dea

SHA256
7fa1612c82053dcaf51857c9aafa281f727f81c1e1074b5f467aa40110a60e6b

SHA512
4f38419aea95544a2722e5fbc2efc8c7d0ca6ff6cdb6aef67275efe2cece223da5680c0e5ce83f9ae732dce5d0b8195741699319ca45fd21c761feee0d7a69ef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
baf7067c29636c7dd730c911d5cbd3df

SHA1
9e994c5da9b6a1c4d96b47853f1dd0c4caaec6e2

SHA256
f658d437d154169495055983ba237f75f1966e681fd2314fccc027fc52ec4c9d

SHA512
127b5bd9c3f27259c7969444164b1f1db22a29d90a832bd7458cc37f363127af7bacc35172ae61f562b7271cb98278f0e76f085d5f2ffce89a36f54c1ff797bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
471B

MD5
ac9c4a5ebd9f52b86dbc9663631cf1b6

SHA1
76f4f562d615af7c1fc6d63f96d1c8032d64f8fe

SHA256
fc9394a1a6e0be15f148fec21940e1dc1953180843af666bbd92fcbdb704d4a9

SHA512
67319654b32eceed63228b3ee4f6586f03669eb0b2361b10cd57c3362c8dcfce87e47d223aafad033ae21dafb27affdc014392ebde921419971f89b9050afd65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
863cd33ae5c856446940b56874a6b848

SHA1
8c5be319f695ff9f3cc8753214157761926e7a19

SHA256
de811232c4ec15546067a61961534b3cbe858849065e0abf7efcb971fdb86715

SHA512
9513b70085e0dd4d5c4d51afcf8fa89a96a88afcc76736331a655fcc7c78a6347fb6a2ae9b1f8914a44d0ca66c1a13f7598bc5776a08860071f7644d13abe345

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
21f1b29f42b5fb2cdb5c29127b9501c1

SHA1
bd9911a75439d01d0e58fdbc3f246e9e65b78312

SHA256
d7bef249d7d558ea7162195010ba33810c67e8947c7f25e06f705fa7eb80e3c1

SHA512
b6de7e490adb852724c762d40720b1dfdf808a6b63876381fc6c908fa43999638f5c2e108ab293d1e4a132b984b92f9a14f428c6adcff44d4db45fadbf80def6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f270a391af8d4b5494f8d13c55176e7

SHA1
3b9a5c38e5e2af175fcec98524469af92d277634

SHA256
4f9b17c0593bd448b6aab4e0198550be675f50168d24b00867714107689e01fd

SHA512
e6b9195961ca65975d6231ba5098e11eff2fede25c53116698b7f196a24e6f43d8b0ce0bd83fdbc9060860178d7475336d708fdf00c9d4fcddf9feb862a9c7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1783727177b2ea748f609d31d125470e

SHA1
bcf4e895de09c38c9692facddc4727446ba4ad27

SHA256
70e8f2017af38a75b004c7a0f3103e38b006a321727bfb7fa58986d144053138

SHA512
d6e6207322c7e2c5ee88e4a912bf6146d2005eb742f234695045ac115074292627505aefafef90fbfdedabe9ee69e3182ddb8a62ca718aec7c2867f18b2f381a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6435273676a1b1aae3da9a796d534c07

SHA1
311a51a57bbb16e076813c13401cc0ffad5470f2

SHA256
69f85790c7b36a14a8e56d08fdd9d473a29f1af588afe763bc0c25c4a2a02376

SHA512
303ee542eb4da6c434cf2ec59622c4f347d5f7ea217a3d683c163d94ed574ed1f87a6111f0d10b244877d9ee9e8677c853b5d508bb6ae3d3653de38b8e087115

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
f341a33f9ca195f0a5c8d0b8fc2bd1a5

SHA1
30ae5f86ca7388c543e2d97d2707fab409f17b4c

SHA256
8ecf67ad05e7e4cffb2147d099c6609155f8dcc1433de2e0583da00a54a7df2b

SHA512
b929f772a0640dfae93419af3902c739e216c2c3faba1da1baca9e0edace5747aaa77786b8770765b6b94647d479e247aa8c769c5bf0b9e2d8a387b6dbf80d27

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59d826.TMP

Filesize
538B

MD5
5e6d6b08e997d311b3041a4e8505bfc2

SHA1
4d6d01eab3043b7306c436a799cc83bd2f6026c9

SHA256
994753992ce1f1760b8891ae5982f32a85ba5ff8445813bf1136dc343e4f95ca

SHA512
c988138ae9cde27e9c95bc72c27dfa529bf8750c3e68db72a36317e96edf7ab79912267c050118aca511a40133f5408c2653c23f215da37538ab865b1b4eab71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
48056177d1c366efd9516654b89249ab

SHA1
bbc29fc33d2e960d502104df0b0809e244e6dd8b

SHA256
32c6fcaa0336ee199c1abdba85524561cb852e6ffd0b32c59c85482cffdf60fc

SHA512
c315157ce481ce785a486a21f8d57ca0b466b5616d5647a86fed6cac074a6703e431a062689899792e9d17d987f48328bc8496225e5185cdcaa738ea4f5b428e

Download Submit