hxxps://devtops[.]online/?fvrjsszu

Analysis

max time kernel
57s
max time network
56s
platform
windows11-21h2_x64
resource
win11-20250313-en
resource tags

arch:x64arch:x86image:win11-20250313-enlocale:en-usos:windows11-21h2-x64system
submitted
24/03/2025, 21:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://devtops.online/?fvrjsszu

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 2 IoCs

phishing microsoft

flow	pid	Process
88	5056	msedge.exe
94	5056	msedge.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "133873247098686281"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1216697136-3907990103-1733992739-1000\{CC4954A9-1F74-4176-9ED2-3B2BBB3F67BF}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe
5648	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5648 wrote to memory of 5924	5648	msedge.exe	83
PID 5648 wrote to memory of 5924	5648	msedge.exe	83
PID 5648 wrote to memory of 5056	5648	msedge.exe	84
PID 5648 wrote to memory of 5056	5648	msedge.exe	84
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4432	5648	msedge.exe	85
PID 5648 wrote to memory of 4936	5648	msedge.exe	86
PID 5648 wrote to memory of 4936	5648	msedge.exe	86
PID 5648 wrote to memory of 4936	5648	msedge.exe	86
PID 5648 wrote to memory of 4936	5648	msedge.exe	86
PID 5648 wrote to memory of 4936	5648	msedge.exe	86
PID 5648 wrote to memory of 4936	5648	msedge.exe	86
PID 5648 wrote to memory of 4936	5648	msedge.exe	86
PID 5648 wrote to memory of 4936	5648	msedge.exe	86
PID 5648 wrote to memory of 4936	5648	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://devtops.online/?fvrjsszu
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=133.0.6943.99 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=133.0.3065.69 --initial-client-data=0x240,0x244,0x248,0x23c,0x268,0x7fff4203f208,0x7fff4203f214,0x7fff4203f220
  2⤵
  PID:5924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --string-annotations --always-read-main-dll --field-trial-handle=1944,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:11
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --string-annotations --gpu-preferences=UAAAAAAAAADgAAAEAAAAAAAAAAAAAAAAAABgAAEAAAAAAAAAAAAAAAAAAAACAAAAAAAAAAAAAAAAAAAAAAAAABAAAAAAAAAAEAAAAAAAAAAIAAAAAAAAAAgAAAAAAAAA --always-read-main-dll --field-trial-handle=2100,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --string-annotations --always-read-main-dll --field-trial-handle=1416,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:13
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --field-trial-handle=3456,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --field-trial-handle=3480,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --field-trial-handle=4872,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --field-trial-handle=5000,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5220,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3672,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:14
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5200,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5624,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=5576 /prefetch:14
  2⤵
  PID:5476
- - C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:5516
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=5928,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6300,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=6292 /prefetch:14
  2⤵
  PID:5880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --field-trial-handle=6588,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --field-trial-handle=6692,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --field-trial-handle=5080,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --field-trial-handle=4240,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --field-trial-handle=5988,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --string-annotations --pdf-upsell-enabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --field-trial-handle=7052,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=6968,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=568 /prefetch:14
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=3768,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:14
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --video-capture-use-gpu-memory-buffer --string-annotations --always-read-main-dll --field-trial-handle=4228,i,17529602576875283833,4484747657547600342,262144 --variations-seed-version --mojo-platform-channel-handle=4920 /prefetch:14
  2⤵
  PID:3260

C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\133.0.3065.69\elevation_service.exe"
1⤵
PID:6092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
280B

MD5
ae987eb15fd5136f2fa707a7b1f18abb

SHA1
bc4aa67ba8692031bfead4b653fc6fefaee3dbbb

SHA256
f5e0e4ee660e95e1c4f64d5aa134aacf9f7fa1a9b9cfaad10f5b57b24d331d1e

SHA512
fb98d55c498ab80b1f7886b56d0e652e648666bfb13c61c20d495dfb9f2e473e24821efc48f103fb0705e199e56b3e23a0bca82c0296d690104eb0d79032c0f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
7cbd83f23cef94920a785215b6f60811

SHA1
3774c0f2b5e4f5f22192697e335b0abeb9c6dbb8

SHA256
06bc22a0f1cc9adf4bd92b53eeeabcb1c5fae497b5c2ace3fd7f363eb487a733

SHA512
06be92e14a1318d6d56e13971453f2170d44186534899827c3b0e88d7ad6a5d73c59e718cf512ae83be54f7e6292ec6a768b5b70c39700963ff758aea480852a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
3KB

MD5
ed5b339c971670c9f4a1799495fb629d

SHA1
38f2d1b4350a137b4d04803fa0c85675b305fb0f

SHA256
550ad948669dcff3375be1ecae62ea5123d79005c50323ae52464e8753517862

SHA512
adb61d3291630a07751f43509c8ab0671f815cf71e6b73c97d0fc778799b466bead83337c2abe04316edd3446fde6aab5d0d60b80100bed51e2d595f755c58e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe57cca6.TMP

Filesize
3KB

MD5
4f4c3ab542b7802a2ac114cd8ff9cbd5

SHA1
610dcc2a1680e9f9d5d6a1ab5bc33b5393fdf707

SHA256
645bb492e4038f0243ff4fff3dfa69e0c639bf9e28042ce630348ad4aaec75cd

SHA512
f98b99027d53079aec5c29736fb43471ef00a16b98f53386ee8b5c907d51b25301b13e2f4d6a1f526019ced6e1b50ea2da23cbc8e66b1d3fc3dc8dc30687c813

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json

Filesize
2B

MD5
99914b932bd37a50b983c5e7c90ae93b

SHA1
bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f

SHA256
44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a

SHA512
27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps

Filesize
107KB

MD5
40e2018187b61af5be8caf035fb72882

SHA1
72a0b7bcb454b6b727bf90da35879b3e9a70621e

SHA256
b3efd9d75856016510dd0bdb5e22359925cee7f2056b3cde6411c55ae8ae8ee5

SHA512
a21b8f3f7d646909d6aed605ad5823269f52fda1255aa9bb4d4643e165a7b11935572bf9e0a6a324874f99c20a6f3b6d1e457c7ccd30adcac83c15febc063d12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports

Filesize
2B

MD5
d751713988987e9331980363e24189ce

SHA1
97d170e1550eee4afc0af065b78cda302a97674c

SHA256
4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

SHA512
b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries

Filesize
40B

MD5
20d4b8fa017a12a108c87f540836e250

SHA1
1ac617fac131262b6d3ce1f52f5907e31d5f6f00

SHA256
6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d

SHA512
507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
16KB

MD5
8f0c62605c6df6f69ed9874248f5807a

SHA1
e9913e8596610f00952342dc6fc4830297f17db9

SHA256
d0c56ace37dfa5b038182149470473f0d10312779b746435fe721434be7354af

SHA512
22f9c279c265e094a9d72a7908a386df9b3f694f60b3140710cf7839c51c467af97b07f351399174a01b2774ec0df85615085eac55a3be45c7456863cb3e1a05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
37KB

MD5
006f0bd9de5f985d33bdeed0269e28f6

SHA1
09876697c52e0a3b602afd9e680ccf8698b9f56b

SHA256
1714c21f17e7176d2cea83b9ff06124ed666d3303438dbe22fdfe958b2d979eb

SHA512
416191a6c38ec51ee2a95981e3087158288570b9f188903aef8c722606e367cef489f8779f930a4b9110b13a5d6ab1a31f4663ac1c3646dd8c3b1b969ad25631

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log

Filesize
22KB

MD5
6e47fedc8c7b33029520ec1c930c7602

SHA1
750532429c1d89f42112f7ad09da8f6c56285883

SHA256
50db428f348b1ffd32f510d011033f7ffcfb826dfed3f6675699566596f5a2ba

SHA512
334c6540e5a90252d944f8796e7178555f7b82e94944d72974b1652760f566b27e98a6bd3080dd77c4f9aff84e2e21075ea3b5534e7d135096016000b687068b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
50KB

MD5
bae29c8088ea7dabbb401541d87ea8fa

SHA1
f8c39c629fd8399658f3c3130561777bb1b7a09d

SHA256
68c8e116dcfb6a014de62155d7098cbda280e25e7cd5037b640464195771bc85

SHA512
a04b31a1a3354c26723ec9e36c73f609cf892a464626f814ac26e2016d9c435f01a80f9cb5aaeabc1e6976b4d40e0f65b0ca035e4cb1078743b4020e190bb332

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
41KB

MD5
f6fb80825e317029b5dc3f272dd58a6d

SHA1
025bcc772d1886dcf4c216e233e9decf934c2782

SHA256
1b42be4a506d6c8be233a0272a11dfa68979dec927ff719b0ec3754934791a7d

SHA512
134a09803db5964feeb30ed9b083cee6a156001cc36144656ded3c25dbc5e2a4663331feaa2bfead3d64d451b641baeb70b895d05ff2092e5be8bcab271afac5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter

Filesize
392B

MD5
404070a1ae6ba65570787e5fe6d231ef

SHA1
f3e84003df44160e6002f744745f20bdf9716cf9

SHA256
840a4cc1795eaa311479d5b1745ecd396605a35b7888838413c40a912b46d639

SHA512
93df3ad34bbcb4b56721160cad8894be002250e5cf6041db5c7144df5b6eab96efbf928cd4fd9a7bf96b40f1aa684669b496a84e98e4b3cb11c5827aa05095f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe57f637.TMP

Filesize
392B

MD5
7f695c78e84088671f73b2977a40589c

SHA1
ae3d0a09016087ba35b69d00784da8a30b8abbc3

SHA256
bc8aab2ce2cb803a2948b642c7d6e4547ed0de8b24624c4dd42e25f560d00113

SHA512
10652cc77be00ceec2e121fbd31a5947ef87a9f0f255eee1b40804dd3b53bce87ca9799d61cf0f7b27bd70c3b4109b8426776944185052a4add24e89f157024a

Download Submit