limerat | deed0b5cab2da69b09bdfba22ee202bd65a035654bed86bab1f3e52f168d682c

Analysis

max time kernel
146s
max time network
166s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
19-12-2023 10:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

043c61b8a76334ad6d6a0c54e20343f4.exe
Size

75KB
MD5

043c61b8a76334ad6d6a0c54e20343f4
SHA1

30f59cbc3a37a73c3639781be6b0f8d87000ab9b
SHA256

deed0b5cab2da69b09bdfba22ee202bd65a035654bed86bab1f3e52f168d682c
SHA512

ff0e7d6c48070efff7b5b0e50723183885fb48192356153d90efa3a0f70cfe86d935ae425dc3ef546af5b3c0371359ddf7a44f7a41b960271a5b2289e264b50d
SSDEEP

1536:dZ8yh449pbbX9ydnfTjvrXoqAExrj2nOyM0pCpPnguvU9tj3hzlpVdcis:dbp9pEXjo8j2ZIvU9LIi

Score

10^/10

limerat microsoft phishing rat

Malware Config

Extracted

Family

limerat

Attributes

aes_key
xxx
antivm
false
c2_url
https://pastebin.com/raw/K8n9JYwS
delay
3
download_payload
false
install
false
install_name
Wservices.exe
main_folder
Temp
pin_spread
false
sub_folder
\
usb_spread
false

Signatures

LimeRAT
Simple yet powerful RAT for Windows machines written in .NET.
rat limerat
Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1152 set thread context of 4812	1152	043c61b8a76334ad6d6a0c54e20343f4.exe	89

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4708	msedge.exe
4708	msedge.exe
3332	msedge.exe
3332	msedge.exe
2728	msedge.exe
2728	msedge.exe
1520	identity_helper.exe
1520	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe
3332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 4812	1152	043c61b8a76334ad6d6a0c54e20343f4.exe	89
PID 1152 wrote to memory of 4812	1152	043c61b8a76334ad6d6a0c54e20343f4.exe	89
PID 1152 wrote to memory of 4812	1152	043c61b8a76334ad6d6a0c54e20343f4.exe	89
PID 1152 wrote to memory of 4812	1152	043c61b8a76334ad6d6a0c54e20343f4.exe	89
PID 1152 wrote to memory of 4812	1152	043c61b8a76334ad6d6a0c54e20343f4.exe	89
PID 1152 wrote to memory of 4812	1152	043c61b8a76334ad6d6a0c54e20343f4.exe	89
PID 1152 wrote to memory of 4812	1152	043c61b8a76334ad6d6a0c54e20343f4.exe	89
PID 4812 wrote to memory of 3332	4812	notepad.exe	96
PID 4812 wrote to memory of 3332	4812	notepad.exe	96
PID 3332 wrote to memory of 4564	3332	msedge.exe	97
PID 3332 wrote to memory of 4564	3332	msedge.exe	97
PID 4812 wrote to memory of 3676	4812	notepad.exe	98
PID 4812 wrote to memory of 3676	4812	notepad.exe	98
PID 3676 wrote to memory of 5012	3676	msedge.exe	99
PID 3676 wrote to memory of 5012	3676	msedge.exe	99
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 2544	3332	msedge.exe	100
PID 3332 wrote to memory of 4708	3332	msedge.exe	101
PID 3332 wrote to memory of 4708	3332	msedge.exe	101
PID 3332 wrote to memory of 1764	3332	msedge.exe	102
PID 3332 wrote to memory of 1764	3332	msedge.exe	102
PID 3332 wrote to memory of 1764	3332	msedge.exe	102
PID 3332 wrote to memory of 1764	3332	msedge.exe	102
PID 3332 wrote to memory of 1764	3332	msedge.exe	102
PID 3332 wrote to memory of 1764	3332	msedge.exe	102
PID 3332 wrote to memory of 1764	3332	msedge.exe	102

C:\Users\Admin\AppData\Local\Temp\043c61b8a76334ad6d6a0c54e20343f4.exe
"C:\Users\Admin\AppData\Local\Temp\043c61b8a76334ad6d6a0c54e20343f4.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1152
- \??\c:\windows\SysWOW64\notepad.exe
  "c:\windows\system32\notepad.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=notepad.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:3332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9131346f8,0x7ff913134708,0x7ff913134718
      4⤵
      PID:4564
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
      4⤵
      PID:2544
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4708
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
      4⤵
      PID:1764
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
      4⤵
      PID:1560
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
      4⤵
      PID:2412
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4264 /prefetch:1
      4⤵
      PID:4396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
      4⤵
      PID:2908
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
      4⤵
      PID:1376
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
      4⤵
      PID:1844
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
      4⤵
      PID:992
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      PID:3596
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1520
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
      4⤵
      PID:3380
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,3876887726003580447,11388709831019981029,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
      4⤵
      PID:1556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=notepad.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:3676
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9131346f8,0x7ff913134708,0x7ff913134718
      4⤵
      PID:5012
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16880110795173487762,17792099274594039996,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
      4⤵
      PID:4364
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16880110795173487762,17792099274594039996,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:2728

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
a70bfa916eff2393f700e2874df50ae9

SHA1
d1f04c3a66ed5f39b7833d1ab53e895f29f531f0

SHA256
002ba4b1840897af035741783cc3a71636569787c4c40a0a54c9b2119f47d931

SHA512
df1a8f1bf209be9383b1231c450cd7008e06cd97084a86651a4a10c53cb9a9947f46dc7c3445117a4b2a121571336966e750e78c8e61bca9a7b8d10fdd864361

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
437B

MD5
05592d6b429a6209d372dba7629ce97c

SHA1
b4d45e956e3ec9651d4e1e045b887c7ccbdde326

SHA256
3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd

SHA512
caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5398ca3873b60c5e9e855ecfe988fbff

SHA1
f8d4f2191aa5c93cedb976e17f6647db7c6e228d

SHA256
895152c366f2fcfbb69946169c3f10d3f1be19ebf280846374e2ae156c8260f3

SHA512
35b23fc4e5762106ff842beedecb964e9e1b12248a72b09ff83aaa0e3f1254a247c1f661c474336df50b6b4f4a4a53ba4c4aa59a938d2fe1c7cfaccb4b1b8dda

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a33eec22185956ad67cc0cd950b2c192

SHA1
70aa6c859d64814cd975955ee95a5dee209c6a78

SHA256
8b238c54950e893d2dfc17a19c6badef7c6016e6fe37d92c6851bba157339462

SHA512
7b3e9134e9a59f7abb8ea816b08d379f92b49df0760e1ac28a694a81be76484a2d3da100734996084d931ee616574daa936049c8c0d1c3aec9db2bfb9aff8d76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7693fc25df768893d71f4deefe654ac3

SHA1
ceff92098353ed597284f1a5aafd673c6cc7ff01

SHA256
18dfb4b708b5b7a91aaaac020cc3ca35bdc7a33b583ff3c2a1bdba34dd893b83

SHA512
85c7eef35ebc022a575cd867e18d0b92c2c847c61b4b9c42a0fe623132cde84bb27e2670f592086a64b9ac9cc730316292c0916803eaf33b4cfe4cccf9a6302c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
91194e5cc83bc4d07f38a6cc6869cefa

SHA1
dab7bb59498418b2a71ce64a2bab62eeb9bd14a8

SHA256
f0b0f1c1c5f626898a5a30b329cb8f2801cbc61263c8f9d3704d7df80774a7f2

SHA512
f05638b59d54c6c050cd00e5e4d6c95441562b57e35538466ac8abd7469979dd775be7d9db9d9cbd2e3bb1d500da21febd4e1c0cb660a1af79f7cc61e7dc2e07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe595db6.TMP

Filesize
203B

MD5
9d3e2cb015b5351d0211b8c61a52c586

SHA1
97fcd25d424487446546ef7e474805dd03823573

SHA256
493adf7a0c981f50e0748a538c1ddac00c2e7c56fe40640f657924700341ef05

SHA512
66e17468fd2d7319201d0ed3055b8146e284377783b7bfb2e6a0a6bd70d31e4d792a6236abbfeba9c09b505fbe0a958dbc6d46d87c7258f3b9ee9d702ddaa2eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
2KB

MD5
318b3caa1419b5b3498e6bfa3a53e22f

SHA1
774709a2f9206aac9a024daa197a219fb3b56ae3

SHA256
b683fb447b4883d1f433b20a0ceed471e7060e592c165ed2a58fd7d0ef882367

SHA512
6d72a3bdb41ebfb1bdb895bd1b0c51dc829a08a123f5486924614f2da65f30220805e3ca8869245f59b5c402c816e63444fdfd010bf7d8e9bee5545dd11985ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
aae5d0abc2d59bdf591ebb95b0466d70

SHA1
af65a043286b2a9c2244dd3bb1d2d3a93e9d5a43

SHA256
6b06af65e9b77209b385337e1eedbaeb2242125af2ad188c6bad2a1b40fa24e2

SHA512
20314b52429e5e0c8dafe37d26bbfd2538a5bdd9152c120739795ef420dbdfe07f7dd55798bb25c530080eb7a15d8c3748cbb15621b1579993d144a970c6a07c

Download Submit
memory/4812-0-0x0000000000400000-0x000000000040C000-memory.dmp

Filesize
48KB

Download