7494783804e106dcb99b46a3e805e7e3cd545aa1aff61453e0817d6e43ad6221

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2708-30-0x0000000000230000-0x0000000000260000-memory.exe
Size 192KB
Sample231012-s1ea2agh81
SHA256 7494783804e106dcb99b46a3e805e7e3cd545aa1aff61453e0817d6e43ad6221
MD5 03e9392383075956a4d4c1759e0df6f3
SHA1 ac3a4cb64b4484c78be8533dd5d02785176e976c
SHA512 c43fdee1db76fa72e99af6b6146a707f27f124367d61c75e3b30bae05459e2a9ca0c3823dca61c886dec67460115d2a0f68c1faa7763deb8180c782e320f7c57
SSDEEP 3072:8wPwJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1Jl8e8h3:8azAmmI0k7vVe0E0YIM1f
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3904	msedge.exe
3904	msedge.exe
2532	identity_helper.exe
2532	identity_helper.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4092 wrote to memory of 3904	4092	2708-30-0x0000000000230000-0x0000000000260000-memory.exe	91
PID 4092 wrote to memory of 3904	4092	2708-30-0x0000000000230000-0x0000000000260000-memory.exe	91
PID 3904 wrote to memory of 4044	3904	msedge.exe	92
PID 3904 wrote to memory of 4044	3904	msedge.exe	92
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 4144	3904	msedge.exe	94
PID 3904 wrote to memory of 3868	3904	msedge.exe	95
PID 3904 wrote to memory of 3868	3904	msedge.exe	95
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96
PID 3904 wrote to memory of 1836	3904	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\2708-30-0x0000000000230000-0x0000000000260000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2708-30-0x0000000000230000-0x0000000000260000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2708-30-0x0000000000230000-0x0000000000260000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd099446f8,0x7ffd09944708,0x7ffd09944718
    3⤵
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2440 /prefetch:8
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
    3⤵
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5416 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4156 /prefetch:1
    3⤵
    PID:2140
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:3764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,13596440371414489697,72099800085991528,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2976 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2708-30-0x0000000000230000-0x0000000000260000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd099446f8,0x7ffd09944708,0x7ffd09944718
    3⤵
    PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4256

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764
MD5 3d5af55f794f9a10c5943d2f80dde5c5
SHA1 5252adf87d6bd769f2c39b9e8eba77b087a0160d
SHA512 2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764
MD5 3d5af55f794f9a10c5943d2f80dde5c5
SHA1 5252adf87d6bd769f2c39b9e8eba77b087a0160d
SHA512 2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 098324e55470c058ef834983325906054e8ad57fd6a4a2c463be0f58b5072303
MD5 5c2a288f2f09a8f43bfffdd23dd3f1a8
SHA1 249eb0abf760cb9b72f360c1260389a21b92316c
SHA512 24f6c3591f5732c6a92b923d0ef4ee6b9caadd2dd040f3f650d9eb0308c18ea7b9e742fbe3712dd9bed79e2f75e54278434c4bdd5a401490ab08959dc658e02e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c796469ed2702c3d43ad01b035a3067eb66c30b6cafa337c742358085e12bc56
MD5 e583aa007ca384df78d73eac359a9509
SHA1 07ff0344c25173522a40de1a3f94defe7593cac4
SHA512 b94df203dc970d7cd113a5440e263b95ab7cc3f20623d52d12479879664b5b044d4b270271e31de08dfc9e7e3d02df83ba16363bc924fcc2c06e9cbdf0f9c0ec
SSDEEP 96:n2kdBr11QCOrKwpvWMoiVmde1SYbMkdfNpumFalUWQyV+VD7AiEwb:n2knUC6KGWMoYbBlIlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 81feef7b12d34a2fc291d330da1ae3970ba0421638da7bb6fb03fe7cb21b7812
MD5 e8a9ac478de7664573cb98fef383a97c
SHA1 d7e8d8a266d33eed49e61d14beb87c763b02f3bb
SHA512 a457f4d4b934f45dd6dc3f79c26e912c78f5b9c2bafcc6d5136f284abe7fb64ebb25d1f501221d396afdb32045b0b0aa4343923ca33f11ac3ea3eccb7753f820
SSDEEP 96:n0kGBr110SOrKwpvWMoiVmdeH5HbUWQyV+VDCzia:n0kegS6KGWMX9brj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2e30128e606cbb41295615af94b1531eee7fc57a1cc58ff481e671a63654a5cd
MD5 f6524218af7aa7caf2a2de195e0ec46b
SHA1 9e2c5a5bcb85987365234b2d38c5128a4d237a7f
SHA512 79c0b901e285fd138ee59f56e5207b509e0dc172ea882a5c039f5be76bc807fc0ddbfd44b1b6daf575a56690ff30a7b081f8077c2bc3548fb0d6cc91dd7058d9
SSDEEP 96:n2kkBr11QCOrKwpvWMoiVmde1SYbMkdfNpuHQalUWQyV+VD7AiEwb:n2kUUC6KGWMoYbBlulrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b
MD5 10f5b64000466c1e6da25fb5a0115924
SHA1 cb253bacf2b087c4040eb3c6a192924234f68639
SHA512 8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db
SSDEEP 768:nvUWZN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTLlqIrUmhlafz:nvUWZNu1jaOLcmhlafz
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 05518525206bca86d77f14eb31850238a36808467dfce9b3b8246be653acf537
MD5 73cac2ca471b463e80d8126257f5cd28
SHA1 744a773655ada0e020279356f989c7ec43ef6bcc
SHA512 8d4c61ca21d20bec4a1e715c6710797b8df9e1a15a8b1344c4926be678d24d2c19bf3346c391d923e40242178db37815a01e3c09d4f0527a98fc9b5ce92a14c7
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe582853.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe582853.TMP
Size 369B
SHA256 fa98b9ee03a653f63764cba8338639cf3b04cad2590cc3c2995e38e7aa599113
MD5 423c8557a150592b55e249ebfc337dad
SHA1 568e7ac0edf3be81fa46e1a39e25ea43dccd4928
SHA512 6b8331efc1b51d82cbb1deb92050fbe962bb6bac48114cdad12b4d55d362e2555897efd81e42fff177588aee806dd3366c0547c82eb5f105826c03912d017e05
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9748908d37ca31039f855a6f6f786f128b78220832a8f574e145c541354b27c7
MD5 6e6686a8911d621de51b64144473608a
SHA1 2a766476ebedb403ac9874178eb0590b6b670a57
SHA512 bb9b5417733e45caeb6c7360b658d6609e6f6b86b44dce7ef334bfb3c3a9c410686f3ee594b17fada1d0b8c0b4a9c78e329a7c187dc23e7efacce1dc47667ece
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupDWLe2RUkdPSXwbxV9g+N5Y:A9iIxuERzA83h09RZxYDWbddPZV9gSmj
MD5 SHA1 SHA512 SSDEEP

Submit Download