hxxps://t[.]nypost[.]com/1/e/r?aqet=clk&r=2&ca=35257893&v0=rhn21600%2540gmail[.]com&uu=65ea915e31188d84ac041994&ru=hxxps://timms--assoc[.]com/[.]well-known/acme-challenge/encryption/00152689/php/connection[//]#/?/ZGxhcmtvd3NraUBjaXR5b2Zuc2IuY29t

Analysis

max time kernel
145s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20240426-en
resource tags

arch:x64arch:x86image:win11-20240426-enlocale:en-usos:windows11-21h2-x64system
submitted
07/05/2024, 16:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t.nypost.com/1/e/r?aqet=clk&r=2&ca=35257893&v0=rhn21600%2540gmail.com&uu=65ea915e31188d84ac041994&ru=https://timms--assoc.com/.well-known/acme-challenge/encryption/00152689/php/connection//#/?/ZGxhcmtvd3NraUBjaXR5b2Zuc2IuY29t
Sample240507-tmaw5aea8v

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
2040	msedge.exe
2040	msedge.exe
4544	identity_helper.exe
4544	identity_helper.exe
1848	msedge.exe
1848	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe
2076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2040 wrote to memory of 624	2040	msedge.exe	80
PID 2040 wrote to memory of 624	2040	msedge.exe	80
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 440	2040	msedge.exe	81
PID 2040 wrote to memory of 4036	2040	msedge.exe	82
PID 2040 wrote to memory of 4036	2040	msedge.exe	82
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83
PID 2040 wrote to memory of 4456	2040	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.nypost.com/1/e/r?aqet=clk&r=2&ca=35257893&v0=rhn21600%2540gmail.com&uu=65ea915e31188d84ac041994&ru=https://timms--assoc.com/.well-known/acme-challenge/encryption/00152689/php/connection//#/?/ZGxhcmtvd3NraUBjaXR5b2Zuc2IuY29t
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffc51e73cb8,0x7ffc51e73cc8,0x7ffc51e73cd8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3188 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3796 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1912,13677003092257520567,15763364681639505474,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3632 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 34afac298a256d796d20598df006222ed6900a0dafe0f8507ed3b29bfd2027d7
MD5 8e1dd984856ef51f4512d3bf2c7aef54
SHA1 81cb28f2153ec7ae0cbf79c04c1a445efedd125f
SHA512 d1f8dfc7fdc5d0f185de88a420f2e5b364e77904cab99d2ace154407c4936c510f3c49e27eed4e74dd2fbd850ad129eb585a64127105661d5f8066448e9f201d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7052a8294dd24294974bb11e6f53b7bf36feeb62ce8b5be0c93fbee6bc034afb
MD5 ffa07b9a59daf025c30d00d26391d66f
SHA1 382cb374cf0dda03fa67bd55288eeb588b9353da
SHA512 25a29d2a3ba4af0709455a9905a619c9d9375eb4042e959562af8faa087c91afafdb2476599280bbb70960af67d5bd477330f17f7345a7df729aaee997627b3a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 7259cdb3c3542b53de99d51d4991982315f561818aa216dda463eb1bc8d1ed6c
MD5 a7718b305e3b9105902bb91ab8504508
SHA1 6af3e54fe9d14a3752ba774e75e643eebcc540ef
SHA512 813622dcd356319f40e3766216a52e781edfe4f1b2f0d74a2a89f6aa441a1b9e143f9737c295f89fb9bdf2d419f5a54f873ec46e2ac06df6a22a82f6b9c6f80f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 cfea1787d7beae2a9700d00a41df6dde587188b746da8e708ba8b75184d05346
MD5 6956377f8bebae858ee9bc1416049b3f
SHA1 2e30f7b750793d46acfdc082b1efb90f25bc8bc5
SHA512 52693293cf1628fb7bb74dec1196b66edb320903b16cb81129d2cb6cec8fae0e830cee1ece0b064a0151de0d7f0737a2fd657298040e9784c6408af3cca63b5c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 36d545c5b2f35a9f2833deca1f1a45e13f8a27960a20443790ba345d7eaccd30
MD5 a814b513ca7fa0bc890d12c3ebf32538
SHA1 575b53cbdf39796f788099ce556fe7d5020b2914
SHA512 c2d3474f482af1760d63817d7183c2827e9128cada5d2931b9eefd882bf60f57c8d9f630ceda3ebc9537a4ec10e05e280f7806f0842b44e05c25a980302fb1cf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b41110d9cda1d41970f0343bbc2ce88e9b87b665fddb56dd4f8eeba5b50b4e44
MD5 46e85cf17730b580527cfa07d99bc38b
SHA1 960974e63e70071e89fb4d4b797fcd9070fb1844
SHA512 8530acfa1ed73d64e6b29691f1e161c120b16f0c6810bd3f7ed122d5564f56539dc088d0f4568e51135600d06108127d124114dfcd822b0309df29b35e5f5e06
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c07cd1e7dcf0034457c082177eb8c9dffb9912f8c33dcff0863c6957467ee967
MD5 3b120d12343ed4ee308b65e608e0679b
SHA1 4ebb0d041747678e5abf8f5764dccad7c24fce16
SHA512 de6188772caf4291ba22dac7363403d957371505995cb8d5b6d5218c4e6b7282636eb4b846abdcd86c7b3f3f942dc4a5f4fc7e665e8c8cfa65dfb35c2c206113
SSDEEP 96:nPk3uxm/eQYmtzXkpwSv0MoiVmdHIuJoWmt0WQyV+VuziX3wI3:nPk3jHlXkpv0MAIMLmtLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dc3cb830236a6b84afd81523b121e1db39b9ae4a28180c4686c0bd5b009ec8d5
MD5 60a6c23221b960d1a1a63fd6c70de752
SHA1 d46f85af9f2c025e5580d336e4722ff60580aab3
SHA512 8088a08597ca448c39415cf0d665b56eeccee9a06fc7cd2c792011b6fbcd4c1e24c56ffae151a3831368fb48b63ee283af0869b9c50e92eaeb98291ad08f42fc
SSDEEP 96:nPk3uxm/eamtzXk3wSv0MoitBhRJR5mdxuE1jIQJoWmt0WQyV+VpAiX3wI3:nPk3jmlXk3v0MZLauEhImLmtLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5a71766ba32a94fa4a6d67f31aba23ecc54c23ea6cfede76eaa02d05a692cc9d
MD5 ad615415b47aefdd4451881a02206a46
SHA1 b5b8fdd1cf11ece12438afe1e1a52c43bd3368c5
SHA512 57a3699575d72e3fb0bbb49dcfd3f98deeac7b00861fa485a819e7a3ed22bb9356ff32ff0b1d12e16c6adcb905ecaf1559f26baf7f0d4953d1dcb60614fe0ffa
SSDEEP 96:nPk3uxm/eumtzXk3wSv0MoitBhRJR5mdxuE1E2IQJoWmt0WQyV+VpAiX3wI3:nPk3jAlXk3v0MZLauES2ImLmtLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 e01557b58084b0f3fd61669968a7770f917ba19617f35ecd7b251623478a3e8e
MD5 e1b4575d18414ee1850a873792797d37
SHA1 3ccb8df1c3d2495a754975833bf9c89f7ef1afe7
SHA512 4ccff8cb0dc93060731ae3eea02dc3365c5c5c1cd8fdef2969be77310a73ce2b4fde6ed161ebb57766acdd25cd439dfbf915f3ecbb72c8232eea032194fa3ae3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 873B
SHA256 ef8c5c08a2759d17f1dbb967de604c7fc74eaba57fe8b42a66db2f167ef5aee1
MD5 fe094b600a1e9863ddd86e46e6390a93
SHA1 ff748d6a0accabc0600a4e169def02a0c8b30d32
SHA512 93bf80ca16eedf3af7d31087da4800fba6b95211c23cbe262aa56cad68cb05d6b0e5c445c82b94dc87f350ea3a100546cff263e50a989058243e72f373fbeef4
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5864ef.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5864ef.TMP
Size 705B
SHA256 3086c9420b38ccb1ed157614bdb04ac9486e2dc94088bdbf941e79555ee69887
MD5 74db60a53820f7825945ae254eca38c0
SHA1 02be8d76155c06ac46f62f11407cae023de37f5e
SHA512 ac076f1e4458786231292d65d5093016b7b63dfb9c013dbc3c7385e532c60b65c5511b0372378777c319d02ac9378192d38ce24138b89552c353aaad70aaadf5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 03813787f9d3bd2e6b99943431e232d8317c96893504f1dfbc0d32fe9c412630
MD5 fe87adebb70e7019fbdaf25d87b6b9b9
SHA1 1a33d24c8da3e9cb42c710a5ee42d51dead6cb53
SHA512 391b0d2a926c91e6833ecf229b4f9350922308bfd4a0439e37d0dd27043a3e0a01019491727f6c17ef998e7145226a3fcc08daeaa1abef2c4e5d0529e11b2e6d
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGqdue2RU4URLfyZ22TacHlGzv:M9iIxuERzA83h09RZxASGiw9EaQ0VGzv
MD5 SHA1 SHA512 SSDEEP

Submit Download