cb44927decf2fe9a008f9f71908205879fc9922b264c3c84e2574ff2a4557a0e

Analysis

max time kernel
202s
max time network
215s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2023, 03:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2556-34-0x00000000001C0000-0x00000000001F0000-memory.exe
Size 192KB
Sample231013-d3k42aee45
SHA256 cb44927decf2fe9a008f9f71908205879fc9922b264c3c84e2574ff2a4557a0e
MD5 4795c20e4139ea458ec0bdd438e87c0d
SHA1 c64aaf5dab4be9186c7447dcad2a95d48326087a
SHA512 0dcad2193e58c6576e2340aaf464dd7a104cfdb5d4293b1d9c5df09caf064029699d3fc1b199743508a3e4a5c576ce009f466d36302569c1da295df9db860892
SSDEEP 3072:8w8wJp8A/xdimI06X7vV6OPEsUc/W0E0ilHPgM1JA8e8h3:8NzAmmI0k7vVe0E0YIM1e
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2244	msedge.exe
2244	msedge.exe
3668	msedge.exe
3668	msedge.exe
2460	identity_helper.exe
2460	identity_helper.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe
3668	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 3668	4364	2556-34-0x00000000001C0000-0x00000000001F0000-memory.exe	87
PID 4364 wrote to memory of 3668	4364	2556-34-0x00000000001C0000-0x00000000001F0000-memory.exe	87
PID 3668 wrote to memory of 4968	3668	msedge.exe	88
PID 3668 wrote to memory of 4968	3668	msedge.exe	88
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 3484	3668	msedge.exe	91
PID 3668 wrote to memory of 2244	3668	msedge.exe	90
PID 3668 wrote to memory of 2244	3668	msedge.exe	90
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92
PID 3668 wrote to memory of 1884	3668	msedge.exe	92

C:\Users\Admin\AppData\Local\Temp\2556-34-0x00000000001C0000-0x00000000001F0000-memory.exe
"C:\Users\Admin\AppData\Local\Temp\2556-34-0x00000000001C0000-0x00000000001F0000-memory.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2556-34-0x00000000001C0000-0x00000000001F0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb30a246f8,0x7ffb30a24708,0x7ffb30a24718
    3⤵
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:3484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:1884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
    3⤵
    PID:396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:4180
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    PID:4508
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5200 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
    3⤵
    PID:1360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
    3⤵
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:1864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,15278020202665018705,7103416710979156582,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1720 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2556-34-0x00000000001C0000-0x00000000001F0000-memory.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2420
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb30a246f8,0x7ffb30a24708,0x7ffb30a24718
    3⤵
    PID:4732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 106137874d86d602d1f4af7dac605f3470ec7a5d69b644b99d502bb38925bbd3
MD5 f95638730ec51abd55794c140ca826c9
SHA1 77c415e2599fbdfe16530c2ab533fd6b193e82ef
SHA512 0eb01b446d876886066783242381d214a01e2d282729a69b890ae2b6d74d0e1325a6bd4671738ebe3b6ecadc22ceb00f42348bad18d2352896ed3344cc29f78a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 129aad189d939893f4bf16cca01f4d15ba66ab6fcbc119b71f39bf5bd6add7de
MD5 0bd41d16fafce794d2fd8a4aff13b168
SHA1 e5b7ce15679f2312f0005826dfbb16178834c0a9
SHA512 1d13e76318776473a76085a18540aefe899c1e11166944288d41686b75049bc027cc5cb795e6fa0e4bc68b8b27662ce01fe0459755398131d11a40545faadaf7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 eac5fce8067caf5c6853af3cb1fedbb3f786fc9558382f02c6bd82e71e31bbf5
MD5 2a37e514dc575ae297134c900dc4e81f
SHA1 d4f55b30e424217c52347c8dd4a98fe3f02765e1
SHA512 5dcaecf050c9d2152fdeb2ec5a75ddedbedfa639c17e91f61c12852675a2797626644e479c0953141f85b122b7c611acbf05021aced3a9e6401541f7efbe83c4
SSDEEP 96:nI0kGyr1cXwpvWMoiVmdeHBsLU1d+UWQyV+VDCzia:nRktrOXGWMXCQ1d+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 cf383e6278cd7229c49966bcc9efa111f574f012a568c4c341c099aecec5c617
MD5 fc10e4194109f74c84a783963d246809
SHA1 97327f5967eba7933f0a23cecd7fb262d5d06c0f
SHA512 ec9cad771faf95666396352c9586670ca34692a530f0c21631fab4c3ab01046f67d965f1e7f3e26953bfb809a77ce3fceee7730198fdbb4102eadd61d21d86f0
SSDEEP 96:nI2kkyr1cHwpvWMoiVmde1Sue1jBsL01d+UWQyV+VD7AiEwb:nbkrrOHGWMEuehCA1d+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3c76a86113c0287153369dad94f10f89e1b415c2fe2d19a89ccf6ac39ab8d2fd
MD5 ed710bd6230e9624a9b1c6ec725caf39
SHA1 e1bc42d9390f785db5a4bf101864d6ffa5e8cadf
SHA512 01e78f118c490e91afa44290152d44140782ab11dceec67187d8cba237cb862862d7c6b666fc9801ce688656bf0837ceabe5fcee41d8da651e9ec0ed044549a2
SSDEEP 96:nI2kkyr1ISwpvWMoiVmde1YIYSMSMkdfXIpOsLWE1drUWQyV+VD7AiEwb:nbkrr2SGWMZYsBQtr1drrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 c225fb924400745c1cd7b56fffaee71dce06613c91fbbb9aa247401ccb49e1ee
MD5 4a078fb8a7c67594a6c2aa724e2ac684
SHA1 92bc5b49985c8588c60f6f85c50a516fae0332f4
SHA512 188270df5243186d00ca8cc457f8ab7f7b2cd6368d987c3673f9c8944a4be6687b30daf8715429bd1b335391118d0ce840e3cb919ff4138c6273b286fb57b2b6
SSDEEP 768:nTUWLT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpLl3ArUwKi:nTUWLTu1jaAL1wKi
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 bc50a5ad801354ff4256ce2f9421a3c0b24658aa6ca0ec53023394f0b6dc73ad
MD5 325a119a638ccf9404fafd1941856f4e
SHA1 ef3f3d3c72cbb87c025cc3ca463761c59c3adc9f
SHA512 2ea3ccd46031de04d4cf1b3f177bd7776405df18c090336566f6c80bb9699dc6567e197a86dc8f71f1d4758dafd2248032289d1b4f2ba2646e61454d1ff7794a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58f085.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58f085.TMP
Size 367B
SHA256 ba117f3e3a8262c5b1c8dd99984acbe2d2e06f7d6876bf3cc30c5a703c3ac87b
MD5 ac0ba42f1cdc998c56ab3537673dee45
SHA1 88263346663acc18113ca90b4c94b25ff86d6f6d
SHA512 948b754d8bd0526f0038413a927b3caa7561c2bc8998ae971dfe5bb6e7212f6aec3fdbbe0036b080b2c3f999f6f0511d66a0624232c7824bbdb3094372f055fe
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 86ea6cc9427995af6b137e2d5c5684b4280da581c091a20a9dda9f869d731e46
MD5 c1a78bfcc6eb32f512bc248f79786126
SHA1 7ca8cba525ba50cef32b06082aa6c9a4c4747b12
SHA512 3ea0243a4e1bf2d6dfb37223c999308b5802d685796db237b2e4d49e16a862151affeb1d0365e6f2d2917dbb132fcb75998e60717e47a39e9ad532a15186c218
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUhPOJe2RU9vbpBXT0ayrR2:N9iIxuERzA83h09RZxYuPAApTx0RLiYk
MD5 SHA1 SHA512 SSDEEP

Submit Download