hxxps://url7923[.]marsello[.]io/ls/click?upn=Xn88PJeNIL29Y2OVpP6Ui9EYZtRwTAy-2FanEqeT7KFITIPxx3CQ-2Bz-2BT1Wn5ebq2tm1sqE6eg2vD5bCaw4Eaq12excuENkml2Z-2F-2BVwaqonMgw-3D_Nd4_zn392oq3WCbQR9pQOrSlN3JYr1eawUW29DwOmXQDFEKvXTscqRwDY-2FgKnWU8V7NzSsBCCcv9uzK4FKXWSalTgA6HlLAwSKlyolcXDeTD8LF45bNie8E4gj1okiCjROA7oohXThj7z3M9m-2FNBNWinnLG18DVcdhCQfzNJhXt-2BjJX3oDGgrUxpxb6nYP4CUVxhdHdikKr1HXfjuGHu2zoLcgUWP9p19dUjdS3s3cyeQrCIn04ilggiIUtJNzGNEZ7igcWw1Sdbl-2Ft9lxc1N8MIvtVVZwbma1r2rkKyA6euQ5Q0S46okRR8U4ZfDzPHAlvh

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 15:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://url7923.marsello.io/ls/click?upn=Xn88PJeNIL29Y2OVpP6Ui9EYZtRwTAy-2FanEqeT7KFITIPxx3CQ-2Bz-2BT1Wn5ebq2tm1sqE6eg2vD5bCaw4Eaq12excuENkml2Z-2F-2BVwaqonMgw-3D_Nd4_zn392oq3WCbQR9pQOrSlN3JYr1eawUW29DwOmXQDFEKvXTscqRwDY-2FgKnWU8V7NzSsBCCcv9uzK4FKXWSalTgA6HlLAwSKlyolcXDeTD8LF45bNie8E4gj1okiCjROA7oohXThj7z3M9m-2FNBNWinnLG18DVcdhCQfzNJhXt-2BjJX3oDGgrUxpxb6nYP4CUVxhdHdikKr1HXfjuGHu2zoLcgUWP9p19dUjdS3s3cyeQrCIn04ilggiIUtJNzGNEZ7igcWw1Sdbl-2Ft9lxc1N8MIvtVVZwbma1r2rkKyA6euQ5Q0S46okRR8U4ZfDzPHAlvh
Sample240118-ss2flacggl

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5988	msedge.exe
5988	msedge.exe
2500	msedge.exe
2500	msedge.exe
1076	identity_helper.exe
1076	identity_helper.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe
3716	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	4604	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe
2500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1636	2500	msedge.exe	39
PID 2500 wrote to memory of 1636	2500	msedge.exe	39
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 2408	2500	msedge.exe	91
PID 2500 wrote to memory of 5988	2500	msedge.exe	90
PID 2500 wrote to memory of 5988	2500	msedge.exe	90
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92
PID 2500 wrote to memory of 2108	2500	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://url7923.marsello.io/ls/click?upn=Xn88PJeNIL29Y2OVpP6Ui9EYZtRwTAy-2FanEqeT7KFITIPxx3CQ-2Bz-2BT1Wn5ebq2tm1sqE6eg2vD5bCaw4Eaq12excuENkml2Z-2F-2BVwaqonMgw-3D_Nd4_zn392oq3WCbQR9pQOrSlN3JYr1eawUW29DwOmXQDFEKvXTscqRwDY-2FgKnWU8V7NzSsBCCcv9uzK4FKXWSalTgA6HlLAwSKlyolcXDeTD8LF45bNie8E4gj1okiCjROA7oohXThj7z3M9m-2FNBNWinnLG18DVcdhCQfzNJhXt-2BjJX3oDGgrUxpxb6nYP4CUVxhdHdikKr1HXfjuGHu2zoLcgUWP9p19dUjdS3s3cyeQrCIn04ilggiIUtJNzGNEZ7igcWw1Sdbl-2Ft9lxc1N8MIvtVVZwbma1r2rkKyA6euQ5Q0S46okRR8U4ZfDzPHAlvh
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8dad46f8,0x7ffe8dad4708,0x7ffe8dad4718
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,1357249745490152565,3452910579374851992,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5836

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:4036

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
MD5 1386433ecc349475d39fb1e4f9e149a0
SHA1 f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA512 fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 7c1290c26751f3bbf213963ad7fffcbf02e33a57e6e62413e098766a9d0b07a8
MD5 c3b1570340e10eae9441bf845793cd68
SHA1 a3f19b40e91d8e30a8e926f0e5184e3517822623
SHA512 a89f941c31fc01823723aa4bbbee7ec7538faa7600b144f46152e9a358782981adcadc7c4a9a87fdaa866baf2c00ebd23478bcbe0badb649dc1211510ff5371c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 574e3ba615e7636bd4729fb0cf3ebd3c70d1b44a42bc2b8c963d609ce20099e3
MD5 17fbf1fa98d062659865aec6af12557c
SHA1 3c66040595aadc61cead4915c551d6feba663c4d
SHA512 6d51dd3ec70a28dd4e7cbba32a9e916a49374ff967897094bc2f94b88214968e6eefde026af288ac335bb382dc78fd447ca5596bcb554bbabd5d3d4f3d8dc8b4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 17fe10928aaad977bb07f05926c54125d6d1d73c1b1631f428a70c16c651d778
MD5 20757175680b190a2d40f80c5d802f62
SHA1 3d32898b1c68cfdd187ef82416bee331bbc055f6
SHA512 7568ff07bf4fede9d5dd983b732b9b815ef5419470bd187625f79ce1d86fe1cb572c0f7c2caf61bd490f6250184b04481d5320fd220ca7b0c1ef263556fa9768
SSDEEP 96:n+kYVP1/PaO5wpvWMoizR5mdewu71I28P853UWQyV+VD7AiEwb:n+kcB95GWMzOu7+2e8drg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dc816be5bf98dc5974e06db73572242b12741ae4bdbe8caafa27a6b7bc8aa431
MD5 f92d18a293b25fe4f51b624a44e18648
SHA1 b2ab28394adf43c50acf86ab01af3ffebcc26f22
SHA512 371ce025f61d9e67c73e928577c996044a45e0e633a7f296077c3d03e3c6525668b5e4e858506e8957f7a62f84ff6e215c97c5ed9da6655ceb0ab6715cb05f4f
SSDEEP 96:nMkSP1//aO5wpvWMoiVmdeH8P8+UWQyV+VDCzia:nMkIBt5GWMXe8+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
MD5 e664066e3aa135f185ed1c194b9fa1f8
SHA1 358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA512 58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
SSDEEP 768:n/MWlx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvLlJorUlrIffY:n/MWlxu1jaaL7lrGY
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 28c7a8bb7193b2717f2c01959241a84ddc2d6523cfdb4e8f2bcbddc1f037afd9
MD5 b698b586c6a3269af7828362fc7165cd
SHA1 dece9f3d58b13b4c39301de3e2ee73051496b524
SHA512 a3b7ac4bbfd05696022354928f782996c6f28fb3583e002b1191b39815e2cf641c7a379fcd5d00e2a2340ad8fbb65e6ec457a428d620baf657c8498e178eebd8
SSDEEP 192:qoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupnVe2RUMeb81BRHdCnR7Du:u9iIxuERzA83h09RZxYnRp1BBcnZDu
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4604-157-0x0000027C5D160000-0x0000027C5D170000-memory.dmp

Download

memory/4604-173-0x0000027C5D260000-0x0000027C5D270000-memory.dmp

Download

memory/4604-189-0x0000027C655D0000-0x0000027C655D1000-memory.dmp

Download

memory/4604-191-0x0000027C65600000-0x0000027C65601000-memory.dmp

Download

memory/4604-192-0x0000027C65600000-0x0000027C65601000-memory.dmp

Download

memory/4604-193-0x0000027C65710000-0x0000027C65711000-memory.dmp

Download