abb1829425e80b08edb2d7ad55b6f2490751aa0c7bdd10cb43d45433893ed563

Analysis

max time kernel
149s
max time network
157s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2023, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.exe
Size 390KB
Sample231121-rh7desff9w
SHA256 abb1829425e80b08edb2d7ad55b6f2490751aa0c7bdd10cb43d45433893ed563
MD5 788c6ce5e2a5f42512c6f94cfc47d350
SHA1 376ebcc6f79636e8a2169c5f2cf1fa6f99ba1d6a
SHA512 887e6e5b26d376667bf96451fd0971e20259a82e9c8b4dc3dc7b386d9e0643ba60570c1984d094fc8148af5845b51e4eec1089eb4b5711adddae28fe2c6a72ee
SSDEEP 6144:9NDjQ/643GP0C22nFfh84fL7suk20UXfRQ1z/tsPEuBZNC6zXLd3RzOxh7l3N48X:XDjQ/6UGP0Vh7l3W8888hy1HbJ
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4276	msedge.exe
4276	msedge.exe
2728	msedge.exe
2728	msedge.exe
1316	identity_helper.exe
1316	identity_helper.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe
5468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe
2728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 2728	1924	file.exe	96
PID 1924 wrote to memory of 2728	1924	file.exe	96
PID 2728 wrote to memory of 4336	2728	msedge.exe	97
PID 2728 wrote to memory of 4336	2728	msedge.exe	97
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 2148	2728	msedge.exe	101
PID 2728 wrote to memory of 4276	2728	msedge.exe	100
PID 2728 wrote to memory of 4276	2728	msedge.exe	100
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99
PID 2728 wrote to memory of 4040	2728	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\file.exe
"C:\Users\Admin\AppData\Local\Temp\file.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff9237e46f8,0x7ff9237e4708,0x7ff9237e4718
    3⤵
    PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2728 /prefetch:8
    3⤵
    PID:4040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:2148
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
    3⤵
    PID:2968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:3900
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
    3⤵
    PID:1320
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5336 /prefetch:8
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:5244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
    3⤵
    PID:5548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:5540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,313740982966582110,7222357393793414204,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3192 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=file.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9237e46f8,0x7ff9237e4708,0x7ff9237e4718
1⤵
PID:5188

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87
MD5 f4787679d96bf7263d9a34ce31dea7e4
SHA1 ebbade52b0a07d888ae0221ad89081902e6e7f1b
SHA512 de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 c988a4c173b2dbd8cdb02b9f43a81a7540d8af5e667a603aa25ce59943dfdb9d
MD5 5d120c7678edce6cdbd493b8d801c0ba
SHA1 f7730aa60395386dbcee6572c3ab79e1273f4e13
SHA512 5d629c8c4c142e35a82e1b189df882cae1563d584b0ee5b5cf44d88626e3d5aed4e21458ca8b66a6219e53734c4c31a4280d4a0d0880212178fc05a5ffe2b1f6
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 78101bb624a0b4d5f88845feb2da9eaa54c90c03f9e208917ddf43bd8a756397
MD5 db3a8bde651a97f61afe9125cbabd1cc
SHA1 d9bd5c7263c50c3a270671afcc74716e92a5f333
SHA512 348ceb4f5416b7fdebbfc255671458a74de50692f174fdcc37d3ca25883353e19d74324c9c9dedaa8fe48d3503d34529d90841b8c68a6cb6d0bd1c88774c4bf9
SSDEEP 96:nCkx+1LpSSRwpvWMoiVmde1ZYiMkdfWpiMF3+UWQyV+VD7AiEwb:nCkodvGWMzYiBOl3+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dd9df4893b922c3dd8d37fe091ca1deb983f23e6093fbc2ad9a9278c1bb2ec9f
MD5 02a899bb1bee51caab438828731a3b55
SHA1 c8319dda6bc5ca3887bf71d22cfb593fc460908b
SHA512 c75a5d0a14a6ea86855005f0d7779d9bb140b82a817435ba12ebc75513f778e3ab8a561bbb5e3e1e9025370bb9c6f81e02470081a6e144a788d8a5cb37d7f286
SSDEEP 96:noka+1HWSSRwpvWMoiVmdeHFhGUWQyV+VDCzia:nokR1mGWMXzGrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed
MD5 3a748249c8b0e04e77ad0d6723e564ff
SHA1 5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729
SHA512 53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2
SSDEEP 768:n4GWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OVRLlYIrUdanucX:n4GWPvu1jakLydVcX
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 935419f72b81fb8011086d6e707599415c75ccc2ef61d72edb5ec209973a2b2d
MD5 5a85980f80889fbe13805c451b835f44
SHA1 adccf72c7b4aef8687ad0afd6f4ac1edf75598c1
SHA512 3ab6e9b82775e31cf5b134ff6556eb0641211f6fd04426c0ae414c090d16fcae76748397ad55d421b0c853f7c481e04f5e7b67a9d8d3b010f9028c9bc80fa5cf
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe583d52.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583d52.TMP
Size 371B
SHA256 1032325bbac76248a57f5dc9b3385007e5ce21c2080a51a524127559db922b41
MD5 126d188eef85a7505cc8a584210b72cb
SHA1 e761f6b8bc05d2e62a52c31c19ff3e0bb0c0fdee
SHA512 52d929e98616f68ed8428c40942a3ef5212685ee78f492fc7c6c84283bb60a7f3f87d701f08d88daa23029c5eeeb155b57579d34cf09bfc95c199cac45c7c79e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f4ba76a99a01a4099e6c37753799cc1ff6e2ba30748b0db182c6ba67b822cb73
MD5 2a5b88e21f61cefddd169c3a42f4a333
SHA1 f1f7f0b4ccb40c583a9c528e995baacc969715e2
SHA512 be5bb3d65ea6c9df623b9b3716006f47084b049733b4caafbc5e7f54e9dac97e5cfd0684572d49fc572fb15e68f1db7f16bdce454832c8ee255e1fdedc820af5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupace2RUHuSrHbN77leIma/i:A9iIxuERzA83h09RZxYaCV4hnUaK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1924-0-0x0000000000400000-0x0000000000466000-memory.dmp

Download

memory/1924-1-0x0000000000690000-0x00000000006E6000-memory.dmp

Download