cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d

Analysis

max time kernel
139s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 03:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe
Size

33KB
MD5

1c0b07204db005390305593e2fa84a1a
SHA1

3527b5821e383e761ce37f6957fdc4e3dda950b4
SHA256

cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d
SHA512

2d5f35a05d80f052d9caecd36fa0c7deb21c9fb99232b5e318c663d2bab36165a92608130762f3faf8209a29dfd11c082dc781f2ea7a559520b0bb0481409b46
SSDEEP

768:nfTZMRYiVdu3xclMNENoM0QGPL4vzZq2o9W7GsxBbPr:nMYthkvN7nGCq2iW7z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
1892	msedge.exe
1892	msedge.exe
3660	msedge.exe
3660	msedge.exe
4816	identity_helper.exe
4816	identity_helper.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe
3660 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exemsedge.exe

description	pid	process	target process
PID 1388 wrote to memory of 3660	1388	cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe	msedge.exe
PID 1388 wrote to memory of 3660	1388	cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe	msedge.exe
PID 3660 wrote to memory of 2832	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 2832	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 5112	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1892	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 1892	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe
PID 3660 wrote to memory of 4336	3660	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe
"C:\Users\Admin\AppData\Local\Temp\cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1388

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc92bd46f8,0x7ffc92bd4708,0x7ffc92bd4718
3⤵
PID:2832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
3⤵
PID:5112

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:1892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
3⤵
PID:4336

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
3⤵
PID:1776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
3⤵
PID:2532

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
3⤵
PID:3512

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
3⤵
PID:1464

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:4816

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
3⤵
PID:4024

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
3⤵
PID:3196

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
3⤵
PID:1560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
3⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
3⤵
PID:4572

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
3⤵
PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7594886464597575239,4542214827224095490,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1584 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5324

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:4252

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc92bd46f8,0x7ffc92bd4708,0x7ffc92bd4718
3⤵
PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2392

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
10cbe08fe8d2fbb443127a0650868896

SHA1
5fc0c5911c69772bf6389917d217b1854be2da0a

SHA256
9cbab386fcb7c40c39aeb69d5ecc1b8830581d68159d418f7cf7c5b8ef1161fa

SHA512
1421d744f492fee389f451d0b8272f8c653dfde8386b99427179704b2181c1384963e9df21f64d41f6f76372f62866276289564d2fc90d580cd1556595c45dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
864b27664a1d7a6995ea8aa089aa295d

SHA1
062256dd780cf610333f3da4a4659d0969380a5f

SHA256
6bb550634884cb2a0503de05b82e2b61ddb209e23df61b378183bcdf2a1decff

SHA512
44780d0a59fce563c94c64360b7fd17ee24fa24c84b84d5d0234e09d644cd3f7ef4d78f68025c6180177373feab9292d67d6d6feaa28e64422899aae9e842d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e2e49fed18767fe3fa17228f2c19175c

SHA1
041e35bc249b388f924fda6d6923bc43cb63dc59

SHA256
3b1d2a523991faf0c287edc2884a2853b47a9ebf97535a382078af25b5733240

SHA512
3f97cbb4baaac6a1c2ac31ec6259db1b9684d72b8cca2e7d9d2d4fc23f5c6eaa49a83d6f7fb6e142d3541b32930ca1049695e27d45c9ef16682bbc64fcab1c56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
29c77df584c8003606ded6aa3eca2f84

SHA1
9cad71f790687d8569cf657ad91831c7dd162a21

SHA256
4bf86b320c6cd3e39ebd572e8710623b4ed7ede3a7b10ea488733d63ac49a353

SHA512
369d1f3f967f3a6fdcb85a8841597ae6e4240fc8cce92db6e01fdd15931881f4daaa0a942623de844cabd85247d840d1b002a7e3e297286a696a4482fd3fea43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
369B

MD5
0fe2fb9e209bb786b0b03f4aec4c3877

SHA1
4d5a50bb729efb5daa2272faef796298bc4a91d5

SHA256
eaa9191c753df1488fdd532aedb8d2454669f6bbe4ee0d82c60ca296595732df

SHA512
af299779e7e8e7f222753a50feea285a6bf15cb2b67301a6da40e6024d26498f86cf7943f3818e383d78006d6144cd689b63d3a8a5f123af37a442970841b23e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584b5c.TMP

Filesize
371B

MD5
2340685af65a43ab8823e4959ba793a8

SHA1
616ee7b5c223e2d960b40250ff46752760d89fe9

SHA256
1d89e3c125a068f2a35e16d3074eaf16ecdd8c374bc2fe90e057ca30c6d1bc30

SHA512
ef591baad77b8966fce1388c252141a36f44c6c002e26304c6559bb137735c9c830359668de3938bb6e06b6f747897b76266e4d5edc6267f5ecf79957fec081b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
98751ae7e15c9a57c78c19bbc158988f

SHA1
034a5a77fc1ae35c066ce50c362047d63bb9d720

SHA256
fd9644b8b7c61ec0e5c1831698a21ac8d77d91dad3bdd95de806d19705bf9395

SHA512
8a67b077f914704ef28ba33cb36107cd45ba304dab447a55c94896a2e2e2a5b813f3d92dba1ca94e79bb1f42d1e7d969fdc99536ac06cff6389ccea2fb51f543

Download Submit
\??\pipe\LOCAL\crashpad_3660_IRIOZJYGCLONKLFF

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit