802c2b5aeeca6c9ed8ca7591cdaa755c2729a49306ef50b2ea938c58b71ed2b0

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
08/01/2024, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4bfe889eada3522d604cd305a47d0189.exe
Size 78KB
Sample240108-vmwdhaeagk
SHA256 802c2b5aeeca6c9ed8ca7591cdaa755c2729a49306ef50b2ea938c58b71ed2b0
MD5 4bfe889eada3522d604cd305a47d0189
SHA1 a4c4eb5080e8babd9190764ed1a8d10ce4014545
SHA512 48e83ecdca58472df14f6c6a48c8d8d560327b4365967f22c0f18b7c1bd544d9dd809c9b1c7cc8bafd91cf994f0d3c80232c402648c41fb6c2ffdacebad09dcf
SSDEEP 1536:K5jSGdy0MochZDsC8Kl/99Z242UdIAkn3jKZPjoYaoQtC6Z9/B1pK:K5jSxn7N041QqhgR9/s
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
2572	msedge.exe
2572	msedge.exe
3824	identity_helper.exe
3824	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe
2572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1452 wrote to memory of 2572	1452	4bfe889eada3522d604cd305a47d0189.exe	96
PID 1452 wrote to memory of 2572	1452	4bfe889eada3522d604cd305a47d0189.exe	96
PID 2572 wrote to memory of 3712	2572	msedge.exe	97
PID 2572 wrote to memory of 3712	2572	msedge.exe	97
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 1072	2572	msedge.exe	99
PID 2572 wrote to memory of 4316	2572	msedge.exe	98
PID 2572 wrote to memory of 4316	2572	msedge.exe	98
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100
PID 2572 wrote to memory of 180	2572	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\4bfe889eada3522d604cd305a47d0189.exe
"C:\Users\Admin\AppData\Local\Temp\4bfe889eada3522d604cd305a47d0189.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4bfe889eada3522d604cd305a47d0189.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd2e446f8,0x7ffcd2e44708,0x7ffcd2e44718
    3⤵
    PID:3712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
    3⤵
    PID:180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:3296
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
    3⤵
    PID:4280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12997876262427903471,14362101996068989436,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
    3⤵
    PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4bfe889eada3522d604cd305a47d0189.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd2e446f8,0x7ffcd2e44708,0x7ffcd2e44718
    3⤵
    PID:4964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 301bc37ca5e4b538bb9b90038dd20665ffa7ab4ec101d04b5f5015d0915684b4
MD5 e6ee764483c9586deccc47786aacb73d
SHA1 1f747bd18c3d43b591592d014dac70c392bdb1bb
SHA512 1e41bbf819ee1d28967959896457aa4d4d190fd7aa31efcacf9c7f6e264ccdbf1e71c7422f2cd2c83fe6cd9ca2e2320676411be4a53d938217a2c96462c250ed
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b56244ebbc9c3737ef1faf88a034ac44c421425d6b4f77893b9c1493df13ff4f
MD5 4aa555b1361ae421b929ffd41dd31b74
SHA1 c13399938ae1ea430f9100a61f01f3f6a8cb1edb
SHA512 88b6283b8b08e8a34550e5347c3b8e422a679e364b332f1de4d1e42f49d636770a507659b40a0e7ef6c619f1f40aa5819e56180cc7e330d0b6b65da00501e4c4
SSDEEP 96:nFkfj1BTQTlwpvWMoiVmdeHcurv+UWQyV+VDCzia:nFkrjsTlGWMXdrv+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ae8e4d712256213c8f0449989367206f830350abebf29fcd4b63e83aa0960b37
MD5 7152b6802e10893d3f44ea5be5e8a707
SHA1 8e7c6c3ab8e23295cfa82a4b67dcd478a10bb75f
SHA512 5270b4939e1b43d79580b0b7ed8e2ee79aada8f9a507a83ef4a4ba17facd2423ada1685724d045c6ef8186eeb14aaa5c8c5b9b7337e52f95749ec8275aea275f
SSDEEP 96:nHkylj1B4jlwpvWMoiVmde1IYcMkdfvpTmrv+UWQyV+VD7AiEwb:nHksj4jlGWMSYcBn0rv+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 eeb015e3e5c6774ff50ef4097214b7f94b8e864114028080a966e4e35a449d4a
MD5 fe12b28bc3226272d93944f82dd8edf7
SHA1 b80164ec23fe78a99aec1020a239e40ea96bb996
SHA512 1213ad13ea4462c41a482ed9f8d0ecbb37e4a89c68ce0d3b3bab5e3c37f1d0fa8b0b8a96f2ded2af37c34e37bfdb453392adb2608736a6f2ed2bd799b7c82eb6
SSDEEP 96:nHkytj1B4TlwpvWMoiVmde1IYcMkdfvpTmrv+UWQyV+VD7AiEwb:nHkoj4TlGWMSYcBn0rv+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
SSDEEP 768:nrCWQ08F1+UoAYDCx9Tuqh0VfUC9xbog/OVSLllmrUBd:nrCWQ0u1jaXLVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 872aa9de7fe5db567194c7ba573b2d47641314d700310b7c249b51d586df894a
MD5 4f538667744d7b6f28451d46042d19c2
SHA1 8a5cd55d0e12e80d1a0a83a6e242a22dc0ddc0c3
SHA512 df49341cfc2a2fcb610ef5621c6c79303202d3cf741dd7f442c7dcc806781cf9dc95dc460d203f8cddf0b45ea35514b773384d52033e84e7415bcdd7dabcbf5e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 2267ef4fdc37ea02d617b9890dd6f95b1230256f96f8e6b055c4ac3e2f89af5b
MD5 75a63f6c627c18a94af2d53ff5d9809f
SHA1 741ee1674970679772d8aa4f0246c4cb509b5a55
SHA512 8c542bf3f5cf7098f3f277c814c0b82fb84a054383aa8c766982073b71f47e4e63025024b9fb29635b7557ec0e593b92d7a95b3b4779344b3722c5f18d86062c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe594992.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe594992.TMP
Size 201B
SHA256 d705efbd23678ba21505e88ebdba15aa7cffe7aeee64727e52545b6f9c9a5f73
MD5 447ba0750030297dba7a49583f44f49e
SHA1 cdd128b1c0780073434a2956d817bb505a3fbf18
SHA512 01ed7dfe165bade633ad1d957774f3a4398750f217c5d10aa5a27300893b6b9918b2b669c485efe3db9960c783ce4d276e892a0b8657ee35f498fb98210983e5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 99231bd72ba6c5cc14c716e47164bd423cd3fe2b794a0b84ab814aeca4142b04
MD5 ee4363f92d1f3948b3195249a8c9da29
SHA1 e01741f1e9667d3c72b24765f8dfcb508259a0f7
SHA512 23d35e4a60b56fca26dac9d901a42b5ad18331be7c72b97f7886212b27d9104fd996e10ca3ce8a15fd603af3398921181f75167da63a066fdd0af08d7362a499
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupBtz/e2RU5SxbHCEqD38Lkw:N9iIxuERzA83h09RZxYBdq0Ty38wg5
MD5 SHA1 SHA512 SSDEEP

Submit Download