cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26-07-2024 06:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe
Size

33KB
MD5

1c0b07204db005390305593e2fa84a1a
SHA1

3527b5821e383e761ce37f6957fdc4e3dda950b4
SHA256

cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d
SHA512

2d5f35a05d80f052d9caecd36fa0c7deb21c9fb99232b5e318c663d2bab36165a92608130762f3faf8209a29dfd11c082dc781f2ea7a559520b0bb0481409b46
SSDEEP

768:nfTZMRYiVdu3xclMNENoM0QGPL4vzZq2o9W7GsxBbPr:nMYthkvN7nGCq2iW7z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3740	msedge.exe
3740	msedge.exe
2740	msedge.exe
2740	msedge.exe
3288	identity_helper.exe
3288	identity_helper.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe
5536	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid process

2740 msedge.exe
2740 msedge.exe
2740 msedge.exe
2740 msedge.exe
2740 msedge.exe
2740 msedge.exe
2740 msedge.exe
2740 msedge.exe
2740 msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe
2740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exemsedge.exe

description	pid	process	target process
PID 4496 wrote to memory of 2740	4496	cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe	msedge.exe
PID 4496 wrote to memory of 2740	4496	cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe	msedge.exe
PID 2740 wrote to memory of 3812	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3812	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1356	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3740	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 3740	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe
PID 2740 wrote to memory of 1184	2740	msedge.exe	msedge.exe

C:\Users\Admin\AppData\Local\Temp\cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe
"C:\Users\Admin\AppData\Local\Temp\cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4496

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94cd546f8,0x7ff94cd54708,0x7ff94cd54718
3⤵
PID:3812

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
3⤵
PID:1356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
3⤵
PID:1184

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
3⤵
PID:2884

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2132 /prefetch:1
3⤵
PID:3172

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
3⤵
PID:1136

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
3⤵
PID:2200

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5312 /prefetch:8
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
3⤵
PID:4560

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3600 /prefetch:1
3⤵
PID:2984

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
3⤵
PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
3⤵
PID:1900

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
3⤵
PID:5356

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3608 /prefetch:1
3⤵
PID:5436

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,8702108034698065382,13523770441485994260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2892 /prefetch:2
3⤵
- Suspicious behavior: EnumeratesProcesses
PID:5536

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cc20eb2b73a0beb60a8798ae317008f83298ad703468781d8e472c0fe21e9a0d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
2⤵
PID:5272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff94cd546f8,0x7ff94cd54708,0x7ff94cd54718
3⤵
PID:5292

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4700

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

System Information Discovery

T1082

Query Registry

T1012

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\8bc26a90-aa41-4efa-b9a7-7c39fd346a65.tmp
Filesize
11KB

MD5
54d4cbff10c4e91465274cfaa354e564

SHA1
cb61e760d71d1cdfc90ac650372e821e7fd226b1

SHA256
6d8733c0dbd4bf38c0fca5f4e3d9ecbe10900bd7153db73cf7a8b172208ba86b

SHA512
f517ed210e22a6cb3b8d1a309069e1f506610202a53230a2f2db795bf5ecb81d66ae3ca44bd506064077ad3105eed6f3e19c272770a64d5af716e4c948f4141c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
d406f3135e11b0a0829109c1090a41dc

SHA1
810f00e803c17274f9af074fc6c47849ad6e873e

SHA256
91f57909a10174b06c862089a9c1f3b3aeafea74a70ee1942ce11bb80d9eace4

SHA512
2b9f0f94b1e8a1b62ab38af8df2add0ec9e4c6dfa94d9c84cc24fe86d2d57d4fc0d9ec8a9775cf42a859ddfd130260128185a0e2588992bca8fd4ebf5ee6d409

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
7f37f119665df6beaa925337bbff0e84

SHA1
c2601d11f8aa77e12ab3508479cbf20c27cbd865

SHA256
1073dbff3ec315ac85361c35c8ba791cc4198149b097c7b287dda1d791925027

SHA512
8e180e41dd27c51e81788564b19b8ff411028890da506fbf767d394b1e73ec53e046c8d07235b2ec7c1c593c976bbf74ed9b7d442d68b526a0a77a9b5b0ab817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
264B

MD5
6139aa61c42589566a6f8b721435c793

SHA1
31561c9e7672e7bd60cd1e25d95ba0edab69ae98

SHA256
b938fa05e4626d3bb40b8eb0126ee5c8574c4f63f4391aa9ba60fe37ee659efb

SHA512
1686284a301b1eecc2f3288012663046a8365473c5fca6e4db57c545e5d6c4715a2aff803596c71ef2330291c8bb2b045c974e7ff7399470091083bd9921e53e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
9f5f23be1693131c9964bb42184be157

SHA1
9985ef00f702f30bed809902fb1071b13df02bfb

SHA256
db14b751cc9ca157d3baa27b386cac777c113a6f5110f8d26d3b4918bdac67f0

SHA512
db853376b9a46e092b3622b65bf081dd2d7f7c59e447ba686a19aa3d50c0fae553f5a1a022adf20d83a7a14762344d3e06278445b19f9787e529f4ad129b0710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
5KB

MD5
e9a2494097209dc78404f20c2682aac0

SHA1
e7f1331a08afe95bd9aa6fd3b0d0a332359ca4e7

SHA256
f1d69385b5dc3e4dd24e8c59c71c238b7b546ddd10a224cca9e56b0bdcf08944

SHA512
02c6bbb78fb0869a3b03c6bf5da2320a088f7ad6a7cf3b0f99a1b4eb331d78e7a1b23d625fc2af793beaf3fcfbe9031db5bf1743129b1669165d2284dc057ab8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
62fc300449de623b755345dc6639192c

SHA1
fabee5ccbb08ee30c2efec45b01b344d9a83095c

SHA256
b2715534c6b63d042931d313c96b3d27cc1859b519d4cde8e98afa8bac7cb2f7

SHA512
0c6380929ed888307a48d2a95fd57deb2831051f1b268e2c139e3a958449a716c94da8cb3589a1b1c9bea2b48b2dfdef8e98bdbf1b1ca3328a21588a061745c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Filesize
371B

MD5
10737e437480e17035c33eb0361eb68d

SHA1
8c5d2c33640219839d03caaf7f0c849a7cf2d02f

SHA256
bfa7e71b9434df52bc2a3d3749aeb4c964aa5f0ba9999153d3cbf2e4c06fe5ea

SHA512
8d84bee170d47e40da5b9f9dd8e1086f64a71bde3a5039785159b930df7444f8799a0aeb44ea93dc2da6cb53d87974fa799c00c01e99f5acd5ab2f25946f79e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe584968.TMP
Filesize
371B

MD5
16c7b41dab5e6512bc8e1a651123a723

SHA1
c3c879cb70a190e632f82a4ae62840af406ca616

SHA256
481a9c528840e91b5b00abf1a6050cd7c50b1ca2130d6cdfa2d0e0d953e6fb29

SHA512
784f15cf976359c7e1e2822ce85c0694d2a7555657b5f7b250adf772652db829d1c220e48db97951af86788bf17af16ac52ad0744dbbb81ef673e7dc582725f6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
\??\pipe\LOCAL\crashpad_2740_PWKIWJLQIVHWBNTR
MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit