c32f09cdf2c3aff7ef406b0c7a55d568f24a3fd75d49d7bc4af4dbd9fae82013

Analysis

max time kernel
179s
max time network
188s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
20/12/2023, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d9c9833f17da509c44dd5f937792b53c.exe
Size 78KB
Sample231220-s1k4kshbdj
SHA256 c32f09cdf2c3aff7ef406b0c7a55d568f24a3fd75d49d7bc4af4dbd9fae82013
MD5 d9c9833f17da509c44dd5f937792b53c
SHA1 d0e4ebcb0c51f4a9a355f0af0fa2aa33ac1acda7
SHA512 cd64bfd00ea24b075acf8062400a3c565a96a053c5e7b9e0644987fccf1c811d1c2ea7ab84ee498f65239c5c3ad825105a78f3bbd95c64bf3e753119cdaca4be
SSDEEP 1536:3ty5jSxAlGmWw644txVILJtcfJuovFdPKmNqOqD70Gou2P2oYe9Qti6M9/21hx:9y5jSxAtWDDILJLovbicqOq3o+nE9/k
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2236	msedge.exe
2236	msedge.exe
1436	msedge.exe
1436	msedge.exe
5004	identity_helper.exe
5004	identity_helper.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe
1436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 1436	1448	d9c9833f17da509c44dd5f937792b53c.exe	93
PID 1448 wrote to memory of 1436	1448	d9c9833f17da509c44dd5f937792b53c.exe	93
PID 1436 wrote to memory of 1012	1436	msedge.exe	94
PID 1436 wrote to memory of 1012	1436	msedge.exe	94
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 5008	1436	msedge.exe	97
PID 1436 wrote to memory of 2236	1436	msedge.exe	95
PID 1436 wrote to memory of 2236	1436	msedge.exe	95
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96
PID 1436 wrote to memory of 2848	1436	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\d9c9833f17da509c44dd5f937792b53c.exe
"C:\Users\Admin\AppData\Local\Temp\d9c9833f17da509c44dd5f937792b53c.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d9c9833f17da509c44dd5f937792b53c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbe0f46f8,0x7ffcbe0f4708,0x7ffcbe0f4718
    3⤵
    PID:1012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2912 /prefetch:8
    3⤵
    PID:2848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2268 /prefetch:2
    3⤵
    PID:5008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:1464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:1424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:2280
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:2716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:2940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:3396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
    3⤵
    PID:820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
    3⤵
    PID:740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    PID:4084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,6659902356612247682,12583679070641676500,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d9c9833f17da509c44dd5f937792b53c.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcbe0f46f8,0x7ffcbe0f4708,0x7ffcbe0f4718
    3⤵
    PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b
MD5 7a5862a0ca86c0a4e8e0b30261858e1f
SHA1 ee490d28e155806d255e0f17be72509be750bf97
SHA512 0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 e749a1159ad2a38e4e9b42e42213908bfc32cf58a8667c96b6b8ed72d6314355
MD5 1540f649d710c9605832c1709ade9832
SHA1 609bee672f5bccadbc7719c82ae5ab0e1cc8001f
SHA512 4cb59a59567d6fb8746efebc4e5ab13fb1427f3bad0ab551a59028eeddd85c4caa7e0701b5fa4c9e035d9322caa54452e1ddb605b196c7b68cb41ad5b769fd36
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 087189e5f436ee3fc582c3f865861e2847e3867fbc769eea3a2a514a446f91dc
MD5 7a12c2ac2c0e3f21b83a7177a1990897
SHA1 8bc05f20b6abc63bdc526201801b616181100eea
SHA512 618644efedf9d84c3ea59e962d193f3e5c1dd86f8331edea8dd1ac7d68f8ad592e0e76240c4d640ab399e760a60423f0a71abd238869ecc1e082864d4c4a88ab
SSDEEP 96:nSklb1qqwpvWMoiVmde1Aut1jkSnZUWQyV+VD7AiEwb:nSkVUqGWMGuthdZrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 765fd5ad1bde76a3c3e1b3fe0a44a5023c54e83c10f4b073284a24ae40434273
MD5 b35fca83f30483d429adebe541f37c18
SHA1 8b5e29fbf226918ce78e3ec52f6f8bec756cf104
SHA512 43cc0d9d9c2491aed93566f7d39e99ab67ceef7e99ae5da7cf5705628b0f115937e3d8c93614b32203f6d4e0dfb431d7facbcacaf857f9a657d06b057fd6412b
SSDEEP 96:nYk2b1q6wpvWMoiVmdeHkmZUWQyV+VDCzia:nYkQU6GWMXnZrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb
MD5 52826cef6409f67b78148b75e442b5ea
SHA1 a675db110aae767f5910511751cc3992cddcc393
SHA512 f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c
SSDEEP 768:nXwWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2LlxQrUEYtLAO:nXwWPvu1jafLzPtcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 367B
SHA256 4f834594a8340ad5ae379b8b486f9d78d1f8efcaec119f80f46f09fcfaa64ff8
MD5 1dbde96193ae178af77c9c479948a01b
SHA1 9131d35a9c63eda289a5a43ebea747e318553fa1
SHA512 3f67b271b80f93db11f7a4d88d9bd62a58bb1d9c7fdffadc44f678d984547d12e1b36fe7cd451cea2d223d448f1513430a9db36cef6dc0c5815e84dad117b29e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 bc4f4c909e9777549f15ba392cb48c0337deac6ef663e88753eb4932f50f5fea
MD5 8bdfb21bc7a3623502d0ed3cbac786fc
SHA1 4dbb7e5ee7965b5d52f05cac9b743c3404bdd5c9
SHA512 27bd1273f398b9d43ab23e6425200fa4967f2a4b728de99898954a1a88d0fbb037a90e250779683ae7dd37c0c5d06b529e284020b7f9496bd08d2a6678e58e8a
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 910596ded69ccaf49d87daf4d7d5a1f04bdd520d4be0bf922e9da1af4af20bee
MD5 9582b685b7a3c466d518c6d4d1b92aab
SHA1 9597ec9df26a7891846de846d873c4f516233686
SHA512 8bfdca22b8c4f4d89dd7cb031260389790bc59717b33413b950afebec6049dc6d20fec991306410a3764dbbc40d3cbb22a3d3d90e690df4da7a549fc829ca3c4
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe585455.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585455.TMP
Size 201B
SHA256 64bca0deee16ffcb9166897c9ece937b8b2f79c53728063b18ffd3f8b6d796d6
MD5 ca12d1f57c8e9800c624a7c6d3f2bd02
SHA1 0b913f374bba34acfa9fc274c4c8e80260605c83
SHA512 94316bb4a1a1a119d513d6b1bb20e712d7ca59f4def8849843cd8271b49d4b6c8626ffddd82e1977c3d366a10c462309c5e7947f3845e995a51a3e4edcc327fa
MD5 SHA1 SHA512

Submit Download

a8a5deb0-991b-479c-a142-3e1eaefc8b84.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8a5deb0-991b-479c-a142-3e1eaefc8b84.tmp
Size 6KB
SHA256 45007ed9ae50b1bbadbda4caff3f9972186c7df640465b84acd78d96a69bb9df
MD5 9d45a9503297de25ca4c952ee5376330
SHA1 1080f30c65604cb699c4fde742ee005dd445b7b0
SHA512 fe9232087745a6a86b58f359b30cdbb380df42c5fd7153a363edb72a5f910c489a0919ebff482c9227dc3cb93962a283dba40062a2fd3c285bd7d54a9ae2689c
SSDEEP 96:nSklb16DwpvWMoiVmde1yYp8Mkdftp/AnyUWQyV+VD7AiEwb:nSkVwDGWM0YOBFWyrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 93d204e401c8d03ffd8970487fe195be456f3deb2432ee702f02f7bf11286c77
MD5 7fa37cf96d7b220d79fb0a77b01e8462
SHA1 f5e7f1f64357c678c1d22fd6d480dbc18f1f76f1
SHA512 f3cb7496f13bac25d36e8612fcb092cb1ef853f8cb542326d46451ee999fb43039cef401c44e3d5ab418ab691b764a9c9e948020bc7b7edfd39ad493decc4db0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwUe2RUZSgbp2E0LQNkn830:A9iIxuERzA83h09RZxY7uLYGR6Dv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 e877ad90a2c2a81a214a516121f6832c0a53bd9879b0cbaa5d35c4763b3f9da7
MD5 8694ccf9ae480687d94cf26e6c5551b7
SHA1 1345733bbf3e74a9b8e46a68c7c6a9dc41f8f4ca
SHA512 2a788c8ef0ed81031460b5b7034d1a9292c9368cf5321abc6c3c81f0294392cd183024553f5a71d34da0871a8e2293be83764e6aeab71010ab6a083f0b0302d4
SSDEEP 192:uoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwUe2RURFbpGE0LQNkn83HU:69iIxuERzA83h09RZxY7moGR6Dv
MD5 SHA1 SHA512 SSDEEP

Submit Download