e600f0018f81a62de28ca35b58d09fe5f09a5d26fdb5c5ccae9ebc40454d27aa

Analysis

max time kernel
148s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4476-25-0x0000000000440000-0x0000000000470000-memory.exe
Size 192KB
Sample231012-tevassce44
SHA256 e600f0018f81a62de28ca35b58d09fe5f09a5d26fdb5c5ccae9ebc40454d27aa
MD5 ce628db5981db892af1019ed8d7c95b2
SHA1 9c794fb4e7fd32c329c02064e0cd0119509ca4de
SHA512 a1460185c1d077fd89b4673b03b81ecf7f433be1d94d7eaff5d172324825b922a725e19a57564a352c0b59899533cac6b864c50f869df62c25cbe8882849c895
SSDEEP 3072:8w8wJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1JY8e8h3:8hzAmmI0k7vVe0E0YIM12
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
4956	msedge.exe
4956	msedge.exe
2708	identity_helper.exe
2708	identity_helper.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe
4104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 4956	4260	4476-25-0x0000000000440000-0x0000000000470000-memory.exe	84
PID 4260 wrote to memory of 4956	4260	4476-25-0x0000000000440000-0x0000000000470000-memory.exe	84
PID 4956 wrote to memory of 4532	4956	msedge.exe	85
PID 4956 wrote to memory of 4532	4956	msedge.exe	85
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 2380	4956	msedge.exe	86
PID 4956 wrote to memory of 1912	4956	msedge.exe	87
PID 4956 wrote to memory of 1912	4956	msedge.exe	87
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88
PID 4956 wrote to memory of 1120	4956	msedge.exe	88

C:\Users\Admin\AppData\Local\Temp\4476-25-0x0000000000440000-0x0000000000470000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\4476-25-0x0000000000440000-0x0000000000470000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4476-25-0x0000000000440000-0x0000000000470000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffb772a46f8,0x7ffb772a4708,0x7ffb772a4718
    3⤵
    PID:4532
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:1764
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4296 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
    3⤵
    PID:760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 /prefetch:8
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:4696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,18229073846695399348,14903721599295035139,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4476-25-0x0000000000440000-0x0000000000470000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb772a46f8,0x7ffb772a4708,0x7ffb772a4718
    3⤵
    PID:2856

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 f6baa496291dd897ebe140371a567a888cbd8c6bd6504c4bdd46994555be854e
MD5 0e648dce20983a13a1df8aec7154be8d
SHA1 895f784d60e9119f3da83ba12e385879024143bf
SHA512 b5afcc49bb0af4620c29776fa865ccba5a3724e07990f374e3ef9aa7367b36d5ec3dd24df1ce1cad160b618c6d520784136f4c540a09e0d34bbb65334f416a01
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ae15794c6b394fa9a086169be1c2ddf8bbf6831470c02beb913310f6f43d5010
MD5 30b9f469bca8f737e7b530e0c26c702c
SHA1 e4d23fd2ec91c2f5d697c87245c47007ba950bda
SHA512 a4a49624bc0652f56a7d97e525e140c3c097ba1b082658aaa5e6d9ad61e00fff71927a610d608ffc6f8920be86a18b7a91a91e9d2eb1f66ddcf825dfdb39a4d8
SSDEEP 96:npkGxh1ugwpvWMoiVmdeHW2gUWQyV+VDCzia:npkYcgGWMX5grj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fcdb5682d9e4670698f0a2c8d80ad9aab0d80abbc2334ee076380cfebc7f1ddd
MD5 38291d53d4fbc8af3ffce819ac289aa9
SHA1 e9255d1e3d78383da0416662ecdedb4c39041a83
SHA512 63a0494005901d92e66936bcb3fcf415851f426b5af12b26ef140270e8b78af82c9a9e8987df233f1ee5c5b8f2bc4e1fb20974caee5e8be6d0871cb9f98b913d
SSDEEP 96:njkkxh1uwwpvWMoiVmde1GYSMkdfppVugUWQyV+VDCAiEwb:njkKcwGWMAYSBh6grV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf
MD5 d985875547ce8936a14b00d1e571365f
SHA1 040d8e5bd318357941fca03b49f66a1470824cb3
SHA512 ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38
SSDEEP 768:nMIWzY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJLlFprUHfgxo:nMIWzYu1jakL6X
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 b2f663b53397f6f5ea5f3cd47dbe88fa713b06fce8261ce4bcb3747d956cdd28
MD5 d9e7d4537d1b1f231037e9c3d616316c
SHA1 0f4e13bfcc33a2e0da24af66fc689779a5ced908
SHA512 cd44bc07d04a88e6747e0fda991556bc8d1514b4c2de9d3e21b386d96cceda8c193540a42e82b03c739060cb009c3db5c6749a52f5d36fd351f7fcb4f769c79c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58b4b5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b4b5.TMP
Size 371B
SHA256 b62648e46ca17f87d3122575e59cd1e80ee759d875f544528bc616c068222a92
MD5 fbb38f3fe57c393177eb1f75d98ae332
SHA1 0af016cc71ec3d27db770ff4402d9f5154751b94
SHA512 32cd94be9bc29243c6489b5e603444805c17b016d93f65139091ee50bc851753c7e5902450c3a28cc83cc9fe073b9849654d3fceeed9a33592d79cb69b2d989a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ea836c4fd3383de46558b1c525a157d3e21282034b81144a4d7cc80d060df665
MD5 cf614c3e76003c325ef0e1e4dd369d33
SHA1 642d89d637fe4b3a5283a55187efdc226d71dfe1
SHA512 91cf7d3528161fbea3f225bb4b0dbcff7f0c7fe9907677935a59d8a48159f559c797bcb436fbc2710521f8a403a458c2f6546cfff279558ce7bc9e1b63b53e1a
SSDEEP 192:7oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5UMe2RUZS/z209g+N58yag:r9iIxuERzA83h09RZxY5RA309gSmfhrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8863825b3fd7e7b4e365a937dd38abba86935bd320f44a6d348dfbc9024edc43
MD5 b14d7f43a9907be69231d62c237bb590
SHA1 2a5419f8067ab0625b2411ec2961fb55f59cfc22
SHA512 ad54138cfa982b4f2fb04297a0376994ddd68ff6ff98a6b89461e99ddb335f693be582417f4fb8198eceebd7f4027db9386e850e3dc6a5151a14169b9c37bf5f
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkUMe2RUZS/Ob2O9g+N58yX:N9iIxuERzA83h09RZxYkRA+O9gSmfhrW
MD5 SHA1 SHA512 SSDEEP

Submit Download