e600f0018f81a62de28ca35b58d09fe5f09a5d26fdb5c5ccae9ebc40454d27aa

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 15:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4476250x00000000004400000x0000000000470000memory_JC.exe
Size 192KB
Sample231012-sr2pzagc2t
SHA256 e600f0018f81a62de28ca35b58d09fe5f09a5d26fdb5c5ccae9ebc40454d27aa
MD5 ce628db5981db892af1019ed8d7c95b2
SHA1 9c794fb4e7fd32c329c02064e0cd0119509ca4de
SHA512 a1460185c1d077fd89b4673b03b81ecf7f433be1d94d7eaff5d172324825b922a725e19a57564a352c0b59899533cac6b864c50f869df62c25cbe8882849c895
SSDEEP 3072:8w8wJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1JY8e8h3:8hzAmmI0k7vVe0E0YIM12
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
2484	msedge.exe
2484	msedge.exe
4580	identity_helper.exe
4580	identity_helper.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe
1084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4124 wrote to memory of 2484	4124	4476250x00000000004400000x0000000000470000memory_JC.exe	89
PID 4124 wrote to memory of 2484	4124	4476250x00000000004400000x0000000000470000memory_JC.exe	89
PID 2484 wrote to memory of 1860	2484	msedge.exe	90
PID 2484 wrote to memory of 1860	2484	msedge.exe	90
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 4848	2484	msedge.exe	92
PID 2484 wrote to memory of 456	2484	msedge.exe	91
PID 2484 wrote to memory of 456	2484	msedge.exe	91
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93
PID 2484 wrote to memory of 4676	2484	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\4476250x00000000004400000x0000000000470000memory_JC.exe
"C:\Users\Admin\AppData\Local\Temp\4476250x00000000004400000x0000000000470000memory_JC.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4476250x00000000004400000x0000000000470000memory_JC.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd460346f8,0x7ffd46034708,0x7ffd46034718
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3728 /prefetch:1
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
    3⤵
    PID:764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5840 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:1164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
    3⤵
    PID:3660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,13036179450206252544,5219724187711179696,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3076 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4476250x00000000004400000x0000000000470000memory_JC.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd460346f8,0x7ffd46034708,0x7ffd46034718
    3⤵
    PID:376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 18236c88bc4fe576f82223cca595133aa3b4e5fd24ebac9fd515b70e6f403ab4
MD5 bf009481892dd0d1c49db97428428ede
SHA1 aee4e7e213f6332c1629a701b42335eb1a035c66
SHA512 d05515ff319b0b82030bc9d4a27f0432b613488f945d1dae8b8dfe73c64e651eb39f4141a5d2e157e2afb43dd1dd95b6611c1003ac4e2e80511e6c5cd7cfdf11
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 7a4e0fdd93b7a7788d48ca88c57eb5d0b32fb68d8168575760713d01a5561ea0
MD5 6af141986c96a2bc4f743978338c3d1b
SHA1 342e6e3a486100fac68eb50e002985831559cc3c
SHA512 34f85ee4cb32b9886bf63efbe11f6ade7a13d7d04754b1b0cf76843f949b0283d41b5712285b79e6edc724cad4cd866d07463e4ce012655bf9c82d84ee7e8445
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 940956b369d60d3bc80fc77cea5346e32519dc34e82aa195e1297869bbae2de7
MD5 2fa2d546ebe17e62b8d8155a75230e81
SHA1 88574523d2a315e0cff43bc9fc4320993d999a59
SHA512 51724a0d32abc64f4f87b5c97c81782d4bc88b3f8781b086442c9e6b08151d4af30a9127f64ea86dde3cf605a2830fb0fc181e098423b030a991d20e0af2fae5
SSDEEP 96:nUkkt1qokwpvWMoiVmde1TY08MkdfcpFbPUWQyV+VDCAiEwb:nUkoMokGWMpYVBUTrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 988950e5659680570ff9d19796caa2ee92df009d0da3997c1225163f21055f8c
MD5 f1410c4547927bba5a5449da578987ea
SHA1 73ede1ada2ee08dd4176976dc66a6a7389e0d3b3
SHA512 e33bc88683a8ba9dde620d7c6666e766ac12d682bdd193a12efb12496b81abea2732d5e581b4c328be46efb9ec00b5d29fae1a9910ff4415377c122fb4b62282
SSDEEP 96:nykGt1qzkwpvWMoiVmdeHWxUWQyV+VDCzia:nykuMzkGWMXgrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 8ad26364375358eac8238a730ef826749677c62d709003d84e758f0e7478cc4b
MD5 25ac77f8c7c7b76b93c8346e41b89a95
SHA1 5a8f769162bab0a75b1014fb8b94f9bb1fb7970a
SHA512 df64a3593882972f3b10c997b118087c97a7fa684cd722624d7f5fb41d645c605d59a89eccf7518570ff9e73b4310432c4bb5864ee58e78c0743c0c1606853a7
SSDEEP 768:nlxLKKeWwSIq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVrJLlnzxDarU3up:nnUW/fu1ja0Ld3u
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 68683cf9a1a4621367fa1c3cd8469100e04ec2e395f981ea8984088ffad27150
MD5 92aab232de88e1cc67f2e115712a8876
SHA1 c9884582de674af222d48e8839aad1113a5ec952
SHA512 d157fc854b63f02b6cb9dbffdbf97924b0bab2e7ee124f542acf1e189c3d56a907b4a66590dbafbb7f5bfc84296c50eee40e16ddde795e853a6eec86a3fea95d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5823df.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5823df.TMP
Size 371B
SHA256 40ad06cd03a8a3932daa1189abe48345fa7615841d97ccf9ce8050b047abcee0
MD5 41815e3875666108956dd4958de631c9
SHA1 cb60e6c3b7de9cdd29c180bd9ea2b41069889a39
SHA512 0493c26f8c8e643075e2f9f9f35b336af698967ccbaa2125de04447812ef44d72f347e015b7f02c475a900a5d1b21fe9b49d6725e296e4d12ce94d78e43a4032
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fe7e215b0a7ef1b9ad7a7e2caace1cd93d095faf084f03d20340b0533f285c74
MD5 b8886309dc90384e397f9725328d7a81
SHA1 b207ca45aca895b3a48667e34554c8c4971b7588
SHA512 a0d508381c6cb3088d7bbd3e95b6562bd98f3fe906f34b6c0955d291ded14f0c9eed1ef6c6eed57d012be5172b5c7f820845beb97ab0ccff4e12fa54535d670e
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupS9re2RUs0dPSZb+9g+N58n:N9iIxuERzA83h09RZxYSl6dPG+9gSmfv
MD5 SHA1 SHA512 SSDEEP

Submit Download