11d9d265ea091cb12f75c52869cc9a354203f3060f880a2c31728683ab933a28

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 10:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b725ee1451eda6c5b463c93ffb178fd9.html
Size 432B
Sample240306-l252tagd91
SHA256 11d9d265ea091cb12f75c52869cc9a354203f3060f880a2c31728683ab933a28
MD5 b725ee1451eda6c5b463c93ffb178fd9
SHA1 8b9f715cc0965f0784ba89365e5a629dd4d67e13
SHA512 5806dc95ff359a21ade218d14e856dcdeb974d0790872ee5dcf32cbcdf3b273cf2f2209616f285f9e4b1d1f2aa9d0eefecce1bcab6581cb873c3e0dcab334427
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
4984	msedge.exe
4984	msedge.exe
3964	identity_helper.exe
3964	identity_helper.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe
2376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe
4984	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4984 wrote to memory of 2616	4984	msedge.exe	88
PID 4984 wrote to memory of 2616	4984	msedge.exe	88
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 4752	4984	msedge.exe	89
PID 4984 wrote to memory of 3616	4984	msedge.exe	90
PID 4984 wrote to memory of 3616	4984	msedge.exe	90
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91
PID 4984 wrote to memory of 1548	4984	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b725ee1451eda6c5b463c93ffb178fd9.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffae68d46f8,0x7ffae68d4708,0x7ffae68d4718
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2568 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3760 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2096 /prefetch:1
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,17737068724773224801,3641468578348204809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5116 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
MD5 e494d16e4b331d7fc483b3ae3b2e0973
SHA1 d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA512 016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
MD5 0764f5481d3c05f5d391a36463484b49
SHA1 2c96194f04e768ac9d7134bc242808e4d8aeb149
SHA512 a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 528B
SHA256 a124fe2a9055110214d3ac05be2453ca5f068f584ad1f8ca4f6f7c7e6dcd488c
MD5 4679a9a0d72aa2e8238a2c863e0ef7b4
SHA1 3b29500089fb87ca60fc0a855a40a6a6ba2b1688
SHA512 ccb0fb98145e47ead1b11313a93ea8806ec7918eb40a9ce933c0e5608e756e36c5aa2e0193fe50df79ae708306ab8a78b6b187301a8a9f93dbf8acda228d75fc
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 921410ab7dedd525278ade863c6448cc29aa869255ff1bb3400e2d5a7432ab30
MD5 c7444606162e25c474662bec37de4dfe
SHA1 1dd4618a07dd2ab28f6d2ef28b6e3fc73608d861
SHA512 6ee074fcdcd728f210f5dccb2837f38ac05ba6185de9fd9d045ee96e5cb01adfab95d345ae5c36ddc6f54065cb169718c590e13e5f2557ee0ffe19d58724ac12
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e575398db92190f4287e61e0efbf2e06d67a162a74b9f3294aace87925f30ff4
MD5 bdda90153ceac2c18d2f379193394583
SHA1 7b9c42132e428291f398061318d39f6d0d5a4ae0
SHA512 40b76ce7f1a176a7c03dbbbce055825df55236e233ef9794a8b3186f332835692bd3c475b24dabdd61b768f87987001f016a233ba86ed1406d76e265cbbf448d
SSDEEP 96:nUQkExm/K4mqkuG1Ux9jawpvdJWMoiOyRVRtSR5tn1JdeS1SqXC5ehe+UWQyV+VV:nbkdMuGKva+JWMvz+Vl1SqXCWe+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a13871ec8cc2e7cb202333f59948930f9aaaee7fa4556e473127901c4b181063
MD5 cb455ca75ec1c0160e5c8117d74fbdb8
SHA1 baeb27d317d65170441e3279e82a12ad25904ab9
SHA512 3c8752ab8153df6aa1cd88dd8495602c1cc272c631d85008605bfcb36deb288eb8bc51421775616272035e4f60417b5e9dc115db4bb329033c0eea8c085d5a2e
SSDEEP 96:nUQkExm/KQYmqkuG1UB9jawpvWMoiVmdeHbe5e+UWQyV+VD7ziEwb:nbkdTuGK/aGWMXee+rt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 97104fd6511b8ea103b255b2a5dbed42dc67f6d5ae21119e5b4cde24964fc71c
MD5 74904fe049ca69c3b505d7fd54043aa4
SHA1 d4944e5a62d090678b6d5c606f43f43dd878fd10
SHA512 7010d01c18ef3ff22251c8de65590f3455d5649e30f3fa70f9c317a7fee19a01d6df565548fedf5717128ed14d3ebf7bd9d941297c77aebf72f7ef26b5e79b45
SSDEEP 192:nbkdrZuGavaVUE+WMvzv+V5UQSqXJWe+rg:nbfGaNWSeP
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 7795c982213cd3a5b9700a18baf442f594caaedfdaa039af59dc7c85649be639
MD5 266057f5cef9b0d695ae7f6d42e48f4a
SHA1 23b33bc88616b7c65a116be6bd7aba640fd1d6bb
SHA512 40be87fff04d584fbd4d8841e2697fdffc22e6e44f2e6129209178d366e7aeb04bc592dd6c56f6916e33fa1ac1cd0024ca6b41bc3c76efb7ae86b77c7201b390
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe57c004.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57c004.TMP
Size 48B
SHA256 be84b3887fbae7f4667ba7e93363f580c71c1554e9bd2cb851c53d4ede3500ea
MD5 b21abe72fae278155b653b9824e5d8dc
SHA1 0b4fc9fa56bfb27efb93a6ee67c03e9efe83492a
SHA512 fc47c160145768d5073407a3271fbbf642e528594e70100ebe52c281b1272e3392ada074a7d4c4ff41fd96d0605ab8c52e67393564b32fcd09b9040318064664
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 1be34fdc709b0a803902fb3e60757eca6423ad5745a65ce159003bba7ce8118d
MD5 453b90a1218c48b295c755c456bcee4b
SHA1 db10a29603aecbcf9a4f7fb68b2eaf83ba62be19
SHA512 e7f0b0985e016d18dcd9d98754fcf31351ba49a0d488d0d2b720afd65af3e2e3cdf06ccb0685626285d7bb0eff0c212f0243ffebf0fa984e94057751961e96ff
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581db4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581db4.TMP
Size 1KB
SHA256 3c842013e63d5544bbe6dd76849b5765d7651329d5aa61d76d20f956b2637414
MD5 d6bd51b15db829b8edab374d28884536
SHA1 32c4503139b0607c05bcacd3374d5409b0d820f0
SHA512 5762ab3a69670c9068a15e1fb83c62c1dbae625c3714a060da2418dac2a470f45d79e855dac7f34bad4ad582907227c5f2234a48a342c6729e272bb6d96ebf78
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e6282e00edbf03df9f31f8f49ca1f490bc49fefb0ba772e61b65d195a55fb7ba
MD5 fb7b5c0d759da432aa074fbdedb89bc7
SHA1 8baac99fb0cdda83e42f2ca85fafd4f733e7250f
SHA512 2199da98e4f381c4ea92798f30fcbbdc9daa9b6702ff6ea0114ab09187b8f93b8a3e8cba2186b9028cd7e5f2b9b0bbf8912bc444b32a656505ac3c22d9ed0f33
SSDEEP 192:XoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUf5re2RUX/Flb8N9xUX1Mt:v9iIxuERzA83h09RZxYUfhWQN9E1Meu/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 79252b36fdc1d72228617abe9371115dce8f51260c5e485c7a0903151d8b7e42
MD5 7dbd31c167666120ba8fc8a9d87a0508
SHA1 873b1d8d57654bdc0cbde1a44de775dcac732155
SHA512 c4a822d3c0b0d416362d3ec8e76849fd60fed4cca5507f08696590b988e76a9a5e2a3ca6c5aa82269c4e8eba2a89d94524d40515efcb2bde9908240e8bfd7d9a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupUf5re2RUX/Flb8O9xUX1Mt:A9iIxuERzA83h09RZxYUfhWQO9E1Meu/
MD5 SHA1 SHA512 SSDEEP

Submit Download