hxxps://u[.]to/L1oVIQ

Analysis

max time kernel
960s
max time network
964s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22-12-2024 17:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://u.to/L1oVIQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4676	msedge.exe
4676	msedge.exe
2780	msedge.exe
2780	msedge.exe
1456	identity_helper.exe
1456	identity_helper.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 3396	2780	msedge.exe	83
PID 2780 wrote to memory of 3396	2780	msedge.exe	83
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 3876	2780	msedge.exe	84
PID 2780 wrote to memory of 4676	2780	msedge.exe	85
PID 2780 wrote to memory of 4676	2780	msedge.exe	85
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86
PID 2780 wrote to memory of 2696	2780	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://u.to/L1oVIQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd22fd46f8,0x7ffd22fd4708,0x7ffd22fd4718
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2608 /prefetch:8
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
  2⤵
  PID:5920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4828 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4917049473847951218,7829508235716696636,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:5400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001b

Filesize
28KB

MD5
71d8c032980d1a77fc91df75f3b8d0ad

SHA1
6bfa8b406acf9a3572697e493b762fb5a22a4736

SHA256
f60023126bcd28cf0e7afe447e9052a6b505a55c4e5ff4d2a1234039b17375c6

SHA512
cb09472205357426ea767c0759b1175e8aef801a3068e1ed70b64930d878c6debeb7ec2beff48564ae37eed6dde8b18437f0cdfde5a68cc685917447fa7e4505

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c

Filesize
22KB

MD5
5d2d06e403a7a43c4f093c7c408cd742

SHA1
55863e196cfdff655b155ed2c0960913445236fd

SHA256
cd736da48dba022636df45d58ba50f252b576642246e53d6f685c8bf9564111e

SHA512
71b55c6acc0284d11d7e6b33ad6993f8ca9ca2186b65bc377b235e4867dc2645c4079040aa8a24482cdd35d391dc75ef7f2b7633f7197c239d8075946108fcf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
0671cd6a6a27def8a1dfeedf94003257

SHA1
bbab8c6367f9a7597e7155f6ded2f205449800d9

SHA256
d7894e7f411a94ab6b3e78d0c27eaa3ede55570b615c0cc665679ed64dab85a9

SHA512
4c3e10f23364f11b3d4b4dc5040fbf2954adf03d830483ce4d53aca9c14874c13c1b36324a1d6d1ec4ce3dfc925b473dd71b30d3704504608eab54db6079b572

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
01fd90aa2a60fb2a2776926b94042ba9

SHA1
c279e1e7d0ffc8310d811a30ec1bedfcd52d0603

SHA256
089e9c0899324075ace99cf572125576a9a32481a4e440abb36ce2ecbc808310

SHA512
2b47ce7dc61e07c5d8296a3926a7d07b48eaed1a36b602eb66cffa5fef81b6bf1584408f001686bf9551725bf68957b227738b8296b8d02c273d02eff67e639e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
866B

MD5
d5d752b041b6504d4507dc75f8be7149

SHA1
3f7046b2f9b88fcca8a5ea7b70f9671ec8112589

SHA256
68d2bfae20016b406d69cf3f914596d7e5eb23e485742f96aa6ffe0c814ee1fc

SHA512
4106a9b46827fa27699c9bb04ecfdedf0295bfd0f8ac1fa1639fca6bf1d43b6b9794edd5b09671f6207c1aa383b1307293ed700c5fb3dbc5a66df9888c0783e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
866B

MD5
8f87e21a2de87af79faafff491157508

SHA1
c93542b88d865ae9da725cb9d2013ae9804563cf

SHA256
d2118909a4b28416438ae1ddc034811d906a2afd176be8e131b3e72f9624e0fe

SHA512
e63a538fc2d26c43ba83f7f661d235ebfbcc2e362e43f9a382a9106a6ea615c07f5e3f4a0576dedd2a4e4c6390abd77c6d964ff539c8dc339a4556b80c734839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
866B

MD5
860d92b42fbde988a899d46788ebf76e

SHA1
a01d015d2409b36fad3cd3033a88c29bebd7607e

SHA256
ab4c52180a6601d5f746fdaf2a1b9c296dd4b76ce954e2c52c79259f447c8a3a

SHA512
aedf3f2152529622fb2c57c761dc83710258a1debd07b43eb362d56b2ad08fccad32c10a12d2cd34ad95bc69b23186a0fb21f958ffcf7970d4051a341a1de960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
93e146c4ada3cf51e3dad27eb26deac9

SHA1
47dbcd06aca165cd6e43bddfa35ff4319b88d5dc

SHA256
16423aab59d241ca30f929cd450162c56144c30863c60c36e9e515cb1bc332a4

SHA512
c9f102a2e9210023f36d5e5f5bc3c0fb35e34350853d4b47ee6afec32574fedb4b40ab8a1e440ffe20c4a2706b546de13637760ad4d2e8373fe6e9c30cfd0d46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
99681cdadc846b54cf9546729e403421

SHA1
c4e570307018ad2f2204b403bac2ef4661e9d076

SHA256
f5071e6fbb2b6aef8a4b6b9fbbc16b75095816a41df3f14832c9ef5765d7903e

SHA512
7f6c5fd383e0fa712a88e740dbd56cbb043fa3f68d04b3826e6bf0474b32639df7eaad628b3abb2a1b0e8a2f7b99788ca5e2ca3f63e741c5a6ed99bb59090229

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
10KB

MD5
1f65ed52a66df350c37caa9e7139edbf

SHA1
537291fc2e3c1e54d25fb90ffcabd91ce2208aa1

SHA256
a4afe6d11eb52a2f3b446239484cd800337f38a24c541fbd5bfca2626b1bd2e9

SHA512
bf123361748e36d433f7b67e157f0285f0f84f9c7f74cfaddfe23a156e52de685eb9fdec24dea73daafe03ae52c1a3e0c6b4f5bf5247dfc6f6804de8eff0b5f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
3a39cd5cc80e357ae637be8b39cdf83d

SHA1
ef8f230490042761f048379f120b3e150dba0655

SHA256
bae075f58dbccb54cd1eccb823752ff02348f3ad8f52d15c4d19b607837fd418

SHA512
08b5e05dca21916f678a6a67ead76adc55569628e234acc7fe34fbb7174fef3adb10ebff36d6b7fd1468789be2db14f22119bb308875e28702977885db4fe7e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a38d2d188cc747e0e0ed1abf1d9ea657

SHA1
b9d13f5dcb171a7a7f6c96439cb8d07843cdd9a6

SHA256
34a9a0be7eb116a0f9e9042bd5fcfc3e7c88b320bc5bb2d3355f12f27ff3c658

SHA512
0f80f5b069fc8153b1c376e0f42bb50b4030f6d46627dd7c6f3601188aa879812aefc1008f0c1316b0b2eedd1fad5e48701ec49fff7642324e8f647fb963cef0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
52915f43805c8146a38150b349c59367

SHA1
d6e1be024a027bbfd6383d59721d6736959750ed

SHA256
99bf975a3dde0c89bb6a6104bd9842faac16b9c13c777a85d51b19d78a997daf

SHA512
33110c0e56edde8108166ef94a64e7b785f8c71ef3c1de945ff2b21cce04481255683eef15433a58e2904abe36ac5afdd1aca0fdd5cd8b91cd68799bc1c4f629

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
9KB

MD5
ae9560d3e8a11d3fd5bed8420f63ab51

SHA1
43ea39f5eec92efaa0861b3a937327947adcd98e

SHA256
47feb99fb44274cb83c299adfadc69b85f312b83b99f5bd00ac258cb9d5dc01c

SHA512
9f819cc4e7b9a5bf9eac1473b97906225963b3c7caf448f59294a3c3edb1d4d438518098deb40469a5943c9bc7245e2e0b18fbf901414e129514786a4e307da3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
79c4d5ba6cdaaa22ec83417d4b77b0d3

SHA1
7db38b8644780e025966185ab99d05c5e4684084

SHA256
26c7745cd0e106f0f88f752bb21ef8fc781bc65c9f425ac138c51610c2f582d7

SHA512
c1270f4b497f8b8fdde00110162316f91e3cdeb782d371201f0f8c5a84f16369a1f142fb81cf42a14774af45a44aa76ff8148c5652cb0904fbb21bf5469ef20f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
8afa8f1f7cd725b163580d58da7b7d64

SHA1
3e9c07e03bd020690bfba549e91774fb0978e084

SHA256
51e01cf6fb7acd25ac54ac7159d8479e7bbf85914662c3e7145cf4b224ed5021

SHA512
9092acf611fef31765a09279ccdc3b3e686465e7a01b58187ab45a23538c82f3a663e379ef58113fc664da96a4a08e586a9282e9b166e14318f5fcdb9b22739d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
a1a2f0f84bee6cb0217dde56a92b17b2

SHA1
69171511751d21fb4955318c1fbcc8a70c0eae00

SHA256
28d3ca73ad22c39bb209b145650b2e8aa59dcaba4e73ad21629697feeb079264

SHA512
b80556356bd4a63016ddc91cc0f6c043b92075dec1e497de33f0f2811e184337dd3ad66d420308474359c46f6674797328759e5db86f27abe641654e507b775b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58daea.TMP

Filesize
1KB

MD5
0dcd0526e591d43131715a82cfd909e6

SHA1
38212cccfcfd35037559e607cf8b5f0e4979b1c9

SHA256
c8cbaaaba68fd3688552b3544eb1388db87d0ffc4ed4c624e93d9369e2656359

SHA512
d4f0789306464b293127289532d2d1800ede61fbfbb9ac5edbdd269ee84cf932237f708c3bcc3f94237d9c6ca2e91783c1fc28095fae36021f588076f83b84d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
98cbe1d32a6b04446aa55baed993fbbc

SHA1
62679fe759f2278bb243b7637351868b5e906da3

SHA256
81fa1937ee9fc93beab18a11745598ba2af1e19fef2945428dcd3fd25689bb8d

SHA512
2b22703f5711790c40ccf0f2bb494939d11503b88cfa5731b358508fa7ae0fb49355d131b6986642ee3b922af48182d97f0486ce04a9fe0c5f2b4bff71ebc954

Download Submit