c0e7c9338314ebaf19bcea19ca74e0a4f8c39c62bf9937744f78c2c3ed2563b6

Resubmissions

14-01-2025 20:41

250114-zgynws1neq 3

14-01-2025 19:57

250114-ypmqxsxqa1 3

14-01-2025 19:48

250114-yh74aazkfn 10

14-01-2025 19:42

250114-yeyqfazjfl 6

Analysis

max time kernel
104s
max time network
106s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-01-2025 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Annotation 2025-01-13 114431.png
Size

185KB
MD5

793dfe91881d218f704885de52b5ad0e
SHA1

619bdc719abe0ef21e4b2f520f9db8153537d35f
SHA256

c0e7c9338314ebaf19bcea19ca74e0a4f8c39c62bf9937744f78c2c3ed2563b6
SHA512

f573ca94dc59c1d53d0d7dc34a5f8c02db3d08fb2c458e7b7770ff1ea589ccf0ddbc7d7b2eabd03c89bde685490ef9236a92f01f0cf476427a303062b51acf4d
SSDEEP

3072:dooWWocQ8Ewpa3C6jNZWGrYhgduzCOmB9i4B8YMfnvBls6i4DEHzvxJaUHHUsX72:dooW1cQ8PoyIWGzpOy87fnv/5oHrxU8e

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2104	msedge.exe
2104	msedge.exe
1960	msedge.exe
1960	msedge.exe
1096	identity_helper.exe
1096	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of AdjustPrivilegeToken 46 IoCs

description	pid	Process
Token: 33	2972	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	2972	AUDIODG.EXE
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe
Token: 33	1724	msedge.exe
Token: SeIncBasePriorityPrivilege	1724	msedge.exe

Suspicious use of FindShellTrayWindow 45 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1960 wrote to memory of 64	1960	msedge.exe	90
PID 1960 wrote to memory of 64	1960	msedge.exe	90
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 1144	1960	msedge.exe	91
PID 1960 wrote to memory of 2104	1960	msedge.exe	92
PID 1960 wrote to memory of 2104	1960	msedge.exe	92
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93
PID 1960 wrote to memory of 4364	1960	msedge.exe	93

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\Annotation 2025-01-13 114431.png"
1⤵
PID:4988

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x11c,0x120,0x124,0xf8,0x128,0x7fff17f646f8,0x7fff17f64708,0x7fff17f64718
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2020,188921038606659006,11458151164261648732,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=4744 /prefetch:8
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1832

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3fc 0x374
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2972

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
202KB

MD5
9901c48297a339c554e405b4fefe7407

SHA1
5182e80bd6d4bb6bb1b7f0752849fe09e4aa330e

SHA256
9a5974509d9692162d491cf45136f072c54ddc650b201336818c76a9f257d4d2

SHA512
b68ef68c4dcc31716ce25d486617f6ef929ddbb8f7030dd4838320e2803dd6dd1c83966b3484d2986b19f3bd866484c5a432f4f6533bb3e72f5c7457a9bb9742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
22a12dc7f0e9987a0b72e2e47e06d0d8

SHA1
ef43a15ea3eda6518a52b459c32d77784aa7d29c

SHA256
181c8cf53d1b43bb0505b400d92b26bb426d0fbb2b886d665dfe0600dc0f6312

SHA512
6d42a61af6a7d0795b9c905fbd8bfcfb57a1c3f235ed716f575831bb2fad2e01aed442f81f672d51cc1a0abef376138683a05d6f300e44788cdb563f6e37fac7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
341B

MD5
426a9a49d357dd8c3b19d50863329af1

SHA1
1def39621fd12ab9d29f02a83b1fcaf76b21ce7c

SHA256
2673f2536bcee1e209afd43cf4b4d91c7c3d1b1fc6befbf07183af76637be4e0

SHA512
9aa9fb53e3e1a1e99ed2bdb9489a36ad7f4803b23b0e55b5381b35b262e5af1cab60f06dc3b5ee803d0398a4adf50c74ee4ffd255fe3f07ad16897b7625833c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ba02b139caa04d066168144ab6e71ca

SHA1
a5d9e9473491eeda5ae1a69875c6637da373b01c

SHA256
e8843630159f51fe53d03f5938c767c2866b60f76f5bd6df4c3b956375bbca08

SHA512
b3f74af3e4d6ead2635982f10b45da62c7dba42fd52bb0ba2e530296d0dccf57b1aadeb7d097b39ec007357bf5d54f1e1c88bee3364ffd2ebcf7fb01048090d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2408d6afbc0e3f1ba1e106805b5e4c92

SHA1
72d22dfbb9716051a6c4e10b1fa681ba92caf6cf

SHA256
ad1444c087756c6b149b16aee776cab318e91a395219ef82e106ca1b13288e8c

SHA512
6db133c8d9c6d75456253d1565d9530bbdb2ef0f5a717324f4f48d825222b2a354b3aec7055273a95d3ce2636e4b5dc8856c78803335858ab411cdc6ba89afa2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
af80dc2b7c3448a1d2b82c4fde95a956

SHA1
e46b7bc766a35028e2fa464b3f1d8bfa59a9836c

SHA256
735d05b6a0c7447a29e3ff5f406bae4f92217faae1bf315a54965f2f672ba3d9

SHA512
77b185d3e9eb45469dfa92b891d49638bb3ae87301cf698a77b571c4743750a1c5a73d0666863884c9f2f4ee8ed66853410e7935902f86e735104e125294d237

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
58a24a49d3ef1034d2b8f379734b76d9

SHA1
1f86c7e399d31ed3f162f5e515fd43b1e7a4ab4d

SHA256
3de713b82f079c5714bb7471c40111ecf6e5543d34206314978ea2b594274497

SHA512
ecf28f2cedc290a8edde1e50e158d3d6972be0d92a96d0921696e99089e90647214e1fc1db6a9838065e4e8147730a93bba712835c0a835e92ee301e66d98354

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7e3dd3be5c0af5442d560f11be343607

SHA1
aaa788d649be3b9a96f8bea59bbfaee2ea068046

SHA256
3c5ec8d68c95d0f48dcabf1ea061d8de8082caf09bd8ab64e8140ac6f7117bc2

SHA512
0716cc4a3a599288f17fe81d859bc74fbb70eca1fa4b984d29cb8bbe1e74081065987150535b16e3243909cd1761343128c740403cdad433a07ad6d9da34aeb3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0fd5e891a2735cd145694d723a6a2814

SHA1
5e894406d389d44ebf4d88a9b5afc58eae073741

SHA256
bfe72166372141b13fe8f7a370e3a4291fee349e2d7aac983b956e59a23e6041

SHA512
8239cc4f5761e0d9960ca64ebb0e4f556b0f0526ac60831a0583b358facd35ca7286660b806434031c17b828adee7fd996eeccb8f8eb9581056893295d385f70

Download Submit