hxxps://protect-us[.]mimecast[.]com/s/SKLgCo20lPHrnPkKCWqC8D

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/12/2023, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://protect-us.mimecast.com/s/SKLgCo20lPHrnPkKCWqC8D
Sample231218-pf37wabhe2

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
4716	msedge.exe
4716	msedge.exe
2220	identity_helper.exe
2220	identity_helper.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe
4180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe
4716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4716 wrote to memory of 1192	4716	msedge.exe	71
PID 4716 wrote to memory of 1192	4716	msedge.exe	71
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2196	4716	msedge.exe	89
PID 4716 wrote to memory of 2480	4716	msedge.exe	90
PID 4716 wrote to memory of 2480	4716	msedge.exe	90
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91
PID 4716 wrote to memory of 2032	4716	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://protect-us.mimecast.com/s/SKLgCo20lPHrnPkKCWqC8D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb88b846f8,0x7ffb88b84708,0x7ffb88b84718
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6312 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9783071491117545447,746756339193663054,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11
MD5 5e77545b7e1c504b2f5ce7c5cc2ce1fe
SHA1 d81a6af13cf31fa410b85471e4509124ebeaff7e
SHA512 cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 dd0066a781e722e20cd95961da04793fcb4d3ae580cafc71452bb2afe281a9b4
MD5 7fcaabc336188b0a63a15bbc88d4679c
SHA1 5f68335579cb3a373ec2288c93890b9bb1f5a2be
SHA512 840d0a9887ccbf0645feca0c100df35ebb36235811398ab907ff2f0dab721ed9816ab7207121585eba47bac006620a3bdde1a52d9d15e91e259f2da0db1009ee
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 9ee552ba7e5956293a41d434aaac86fb96ccac6596801f9d8e0cdb154697ae00
MD5 500c35261e3b5b1a2e55a7c106c96e4b
SHA1 6845241219acb63f67dbd5ee9a55bb67344f1481
SHA512 12c23c5a4436e39a99d579560d06ac16443f4ca25725092c8323d0ef46ff5ef47bb8cc6abb78edabad59706de93ab38390753eadade9a3f315dd6c48e81dcfb9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 10c0edb9b54070f667e8f3734cda898f322b9b89fb45479932783264d1fb3ab3
MD5 beb1e60b4acb4b738726626e9eb8ff34
SHA1 1827bceb9e02cb925ae459d630d2cafcbd060b76
SHA512 4840dddadb79c4cd9199abc8bdbb5ec01e539dabf7047ce8d9d97dda1644f3ca2c10915535ea0d2bd220f0a989345c8677aa16306a008c2416323eb233efbde2
SSDEEP 96:nSkCD1DhnswpvWMoiVmde/uZ1fVW8G3qTMqFgUWQyV+VD7AiEwb:nSkw9mGWMPuZ1VWtqgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f3d2033ff594c6bdbcc83165ebd01b03556642f489e3139e16d3551d8c102afc
MD5 5fcc2f3102f68d09f4306baedc12eb11
SHA1 5f462135e63bf4783e6e0a6cd10c4c954b948a2f
SHA512 a21e932d1b82524abd66775d545eddee7a40ae32fa2ff0f5a59e92fc747811adb77e1a0346281966e53ab8662e6cc2fbbaebb1b048d82e69c7665d910fe8eff9
SSDEEP 96:nYk2D1DhnswpvWMoiVmdeHTMHUWQyV+VDCzia:nYkk9mGWMXarj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 854cfe0a488fbf7a1ec4d634fc81f14559dfdba60b5fee7131407f8f27303d08
MD5 e323f99201d16009d4f2fbe9fe4f2160
SHA1 d2d80a7ea96efcd4417e41ccdc4b6432f5d1d2c7
SHA512 897258d6259640d7e95868a217feda4db8ec85ef73d79ef64f6810ac719b4393180e28e75dc19482f7f7f45f972912c4b071e387a99d0932da41f610bc8d31f9
SSDEEP 96:nSk0LD1fRnswpvWMoiVmdenwyjhVW8G3qTMCgUWQyV+VD7AiEwb:nSk6VWGWM3wytVWtqYrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8daa625cc402735c3e08f773890d4de8da359d3706e1d8fce37b16be0739bac8
MD5 c15d2a691747ff64e0fa8cfd88e7bd79
SHA1 19134cdbc72cba9856af2282a1b0cf5140db7318
SHA512 35c3bdc96b52488f23add6de4b9223e768aa822e142500082bba7260480046cc4f8061d77c4b79b78d5dc8696a7fefa04d3a91eeba0b9a36274469137a8e120f
SSDEEP 96:nSkZD1fRnswpvWMoiOR5mde7ylh3wyjJEVW8G3qTMCgUWQyV+VD7AiEwb:nSkFVWGWMOJyl5wylEVWtqgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4
MD5 6db2d2ceb22a030bd1caa72b32cfbf98
SHA1 fe50f35e60f88624a28b93b8a76be1377957618b
SHA512 d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912
SSDEEP 768:nYXexSxWTfbn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqELl200zRrUNe/:nYXexSxWTfbnu1jaDELMZzaNS
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1365c35e58797c7517eb4646a54218736dab3035b7419270b4bfa3357d47213c
MD5 756af9453a836e15408daed0e88652b8
SHA1 c429b33b8d41190fa64afbda9fab61073cc64bba
SHA512 1ed1b4d30b8cce49d73965f13ea1dc01e5963c0f1343a9b792339a13bc25e8ac89bd53684882f3aac11f9cdaa280c20a9a0dae8cd014d9d27ea7f41de976e51b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d5391b7bba03b06016792396dd37eabd36b271ce1dc82476b2628c41b16fa07f
MD5 4d671ab6dc663f0a3f366a11c58f820c
SHA1 aef79719c6e7c7cdc5495ffcc2dba77a0409bf6f
SHA512 35a1802c1cdf761543939b9efe1b7e01534ae0305a9da33ff6b72c88374c7ec0d09fd2b6ad9bf4a45cdac97d25a4794154d1a7a413b66020422e10ad1b44203e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57edbb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57edbb.TMP
Size 873B
SHA256 13e72dbe8e28234dd1bee24169cfac7cbc0ff77ee47441ca5c2f269ef553d217
MD5 3de2d2da04135c880b3396900e36ece6
SHA1 10353155b608d8d7d4ea8bb42434f5dd30a5aac2
SHA512 109f105d4f95ce9b99da18bd71b37d8c4e69d762fe3fa59b431c052b64cda3db2bfef0fc73509eb932be6a04b917db11e24ad0815ee352ef7cb2a2156cbd7444
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 129b3eca8ea3c6030781c89b105d1380360ad594294c2940b2a405a94d76c175
MD5 052147636478b6c81bdad09243207dbd
SHA1 893f1a6f3cf3af2c2dfd02e9cd510171798e35f9
SHA512 cc70d12fe0c0a867fce281dc84a8a167443cd1d18691ad78931d26439af0d9ac2959b9b3e11ec8e14c58eef713fe58717ad14eb36cd71e08bed4a0eb017fc305
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkTNe2RU2SCbCbcE0LQNknJ:A9iIxuERzA83h09RZxYsNsbOGR6D9
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 afc4d1bb85eaee7aad0e9f5b43c53e0847aec06c4092714427533072d3eb1189
MD5 fdf9e3f3076e990786384dde3d384e6e
SHA1 d02c5ae56858227083b29ddd178ac55b6f1ce396
SHA512 ee0516a18df535aaf8ff26d38deaa063a0abc63498d973c8720054a260f0647b00b65e3500a6309041821bb5ba81985d3ef52f62192307426fbf216dd4024656
SSDEEP 192:QoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkTNe2RUURbCbmE0LQNkn8m:I9iIxuERzA83h09RZxYsWbIGR6D9
MD5 SHA1 SHA512 SSDEEP

Submit Download