676498f292b3a47c39fadd65d8400735c92d0453aa627b1013cb4fe5a100be2d

Analysis

max time kernel
138s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14-09-2024 19:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe
Size

168KB
MD5

8df48db76679f51e832e0b48a89c509d
SHA1

d1f0f17e91e91cc4e1647c2aa8a7f39af2793125
SHA256

771fb65b9e55db17bca18ea3594e8e8b4d5ef060919844c0641a02d9c3326b1e
SHA512

0e387586091b5455feb19fdfd45cea73f425cf1b8cc8fdc11e68d78826e30f3d148731713c796c0106aee1e756c514fa8ecade656261edc517333245170596c8
SSDEEP

3072:ELUbqjhjDUyx4HCIRoL57WpTlbYsb+L5QgDgZFHdrLTc5wEKctIZ:h4jJ4ORWpTlbYsb+L5QgDgZFHdrLTcml

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	Process
1216	msedge.exe
1216	msedge.exe
2016	msedge.exe
2016	msedge.exe
4388	identity_helper.exe
4388	identity_helper.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe
4708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

Processes:

msedge.exe

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	Process
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe
2016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exemsedge.exe

description	pid	Process	procid_target
PID 5088 wrote to memory of 2016	5088	d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe	91
PID 5088 wrote to memory of 2016	5088	d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe	91
PID 2016 wrote to memory of 2472	2016	msedge.exe	92
PID 2016 wrote to memory of 2472	2016	msedge.exe	92
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 2108	2016	msedge.exe	93
PID 2016 wrote to memory of 1216	2016	msedge.exe	94
PID 2016 wrote to memory of 1216	2016	msedge.exe	94
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95
PID 2016 wrote to memory of 3696	2016	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe
"C:\Users\Admin\AppData\Local\Temp\d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5b7146f8,0x7fff5b714708,0x7fff5b714718
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:3996
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    PID:732
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5156 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
    3⤵
    PID:4524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4040 /prefetch:1
    3⤵
    PID:1748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:4828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,4549218047755494627,2884540845593396079,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3324 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5b7146f8,0x7fff5b714708,0x7fff5b714718
    3⤵
    PID:884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\231d6170-08c2-4a45-bfdc-7b210418bacf.tmp

Filesize
5KB

MD5
4c7d17ca07395407b72ce53e1b8d9c58

SHA1
8651c9e3212bc72a9f87f6904b7a63fd929759f9

SHA256
7c093dba149a3ab8939d6c3c8c7ec7051c2d29115d31673070c6cc8f441d8a48

SHA512
495cac99bac5486020d7b16a6a7864ebb36a62214986a8a573f195aca21f3642dc75b386a9cd125f7dfcecf3faa88c998b14bf99b3e73f39332b544b1b00b2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a6743130b4439c6cfd9fb118a3e0d131

SHA1
896fb11e01156fe5e7202273cb0a308f683fbe7e

SHA256
cbe1552f492188f7bfa00a0d6c2cfa08af46e5406d24015bda2c5f49f47ea651

SHA512
b6ede7807b46827c3fb3b44fb00fe9c35de27b4e4966cc01566a7b95c906c9e01afdded937085ad1928bf42c9d86e683866578e457ebe435a671091bfd14b341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b37f4a1249ca981ce4abf2feeccfbd1

SHA1
1543b5173a277ffa39856af6a0ede07c14e11beb

SHA256
5068e1f3d5a0f6e2b0087565663e72cd1d5094205cf745ea343b0291e4b8143b

SHA512
dd77075981d5fc0da8eac48a3c2e496fd62ca84a2bc5e47ef96c50476df623b0052501078263b7bed0625a65dbb4f2c733995dd630139a821407360747a6710d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7482ebfdd3107b01c7035ba4a51e095

SHA1
e6b380a905a17cecfcea76214727f399b550a776

SHA256
997349b5ec3f5da8d705f6452b4dd2db374eac0db882da4f0c8b878c4958074a

SHA512
86113298091523aea516487d87bd86597173a00bc5a631b630e4e63664c7cdb1cad4c305f60c6f7ea5650c2cf1f0d741e6b005c26e1e6a0ea03cc8719ac77b5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4d60222bd7a0e03619dd5e74b3482161

SHA1
1ab327687dc606a9995a95ab0607ec78ade270b0

SHA256
7b8fe5ce66d780ad1cc55129a56b11debeb1574961eaadd29190f550ff8e3013

SHA512
01467648a1399b316c5dab6c6b00e3dc8d9da12cc165de01485b06384e060c37a528b1fb0a5e56c43f90da664c6f498c077c6766e46de5ca38fc40ec131729cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58360f.TMP

Filesize
371B

MD5
5c1de3557808ba25454251ae841bf229

SHA1
325787cdd03d2381497bc9302e87de7ee8087333

SHA256
f7768141d14f0f92943e2dcc83d2c4b024a3065b2fa49a5fdc47b2ac2f3a19ac

SHA512
57b45c5e092692e42687b581f9be9bd7ba19c081b4489dd3a3dc54e89cee6cac2f9d1f9169c4f7bb7672e9af69321997dea606886a8ee2e2cdcc0cdf2e197db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
87b1a1397f8f702899d5398803b6306e

SHA1
6e435adad5ce84daecb61b3c74adc68c2eac18d5

SHA256
89d4734f1a91161343375eca1662066ffd834be28519ce23184127796ae02150

SHA512
f5945957536964a91e6903ee6311bb7c6e20733f319cc6da24ad28e0a2ada76f91eb7bc7b0d37a2381c076bc456d346fbf61033ae8b388f442d7ee17d4cdfd7e

Download Submit
\??\pipe\LOCAL\crashpad_2016_YLORWEXUXPUGHMSM

MD5
d41d8cd98f00b204e9800998ecf8427e

SHA1
da39a3ee5e6b4b0d3255bfef95601890afd80709

SHA256
e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

SHA512
cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

Download Submit