64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19/05/2024, 01:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794.exe
Size 242KB
Sample240519-bgzzysab7v
SHA256 64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794
MD5 fd74fe4d6bffd361940b2a93bd1fc986
SHA1 fbbbac9077c1c7ced90defcf0dbd6d58aa0cc46e
SHA512 42b1bd8bc38c715fe01d6b01f6e2b974e1ca08f1521454a794c5d1e46f1e4e9334362481fc716c3433a3121ba45a7a6bef7ca1be6639463b910208c521f63ae8
SSDEEP 3072:z+Sfwv3nffwyZs/ZO8WxPpOFGc2EK6RSU/v5TLN75wwF:aS4v3nfftZs/ZO8WBTzEpSaNN7+
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
2144	msedge.exe
2144	msedge.exe
1264	identity_helper.exe
1264	identity_helper.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe
1512	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2144	2004	64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794.exe	86
PID 2004 wrote to memory of 2144	2004	64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794.exe	86
PID 2144 wrote to memory of 1524	2144	msedge.exe	87
PID 2144 wrote to memory of 1524	2144	msedge.exe	87
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 4088	2144	msedge.exe	88
PID 2144 wrote to memory of 5084	2144	msedge.exe	89
PID 2144 wrote to memory of 5084	2144	msedge.exe	89
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90
PID 2144 wrote to memory of 2108	2144	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794.exe
"C:\Users\Admin\AppData\Local\Temp\64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba30d46f8,0x7ffba30d4708,0x7ffba30d4718
    3⤵
    PID:1524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:4088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
    3⤵
    PID:3592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:3440
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4092 /prefetch:8
    3⤵
    PID:4132
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4092 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
    3⤵
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:4664
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:4392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:3456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,4858315691048507295,7458625470289280247,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3844 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=64a89518a214e89cc6c77c49633ded5688fd3efe812bef771bba300ca7884794.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffba30d46f8,0x7ffba30d4708,0x7ffba30d4718
    3⤵
    PID:3152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:812

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2924

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 b85e1570fe5c68623cb6a069ba2739b52d261af6020dbaa22ef8e69d302b4a19
MD5 b7a25191a83f015d0c5eedbce356b517
SHA1 022a62ad26ace2159c3a1a414daf8d308b4e73a8
SHA512 c333dc16a35c08f3558a09f3e2fc5b3ae17cef893a4b4a2e0584c4cf4c97005c0d839c12038774c18231ece69dc171dcd891041344555ca271cbb7742b455f99
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a3d191757a69035f283e11a282044106e3f87eea26e074a92f7821697eb5c17b
MD5 4e29bbd813ac3f8fbde45400664ffca2
SHA1 b3dd0a703063ae813861ec37c057622903f70a5c
SHA512 fa2c3d780884d65c10a8e9e0d7b50e50a18ae4933d053c0b1a160ee727f5deb664f77b90776b70e2be17f2ccd8bf71c3f6f11cf0cc83dcb629b14367160a73b5
SSDEEP 96:nsFkhTw1Pn2wpvWMoiVmdeHk4osUWQyV+VDCziEwb:nsFk2hn2GWMXisro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8c7df984a01be513a891747b4b1fed53dbd21e2b7e952e1bc036b46ad49cfe13
MD5 07f7e474658e3b188d24462812ba4844
SHA1 62dba0028a03c8420ea35af4c0376e1eeb269772
SHA512 ee78c1bdebbf9489d30ad5d8e7f65f381146cd3373e32126cd21c566b01e74a1a47508a4c942ed09ffeb0a3507590df4acd67506394bc758996d58935565d4b1
SSDEEP 96:nsFkETw1jm2wpvWMoiVmde1UYEMkdfSpbMoO+UWQyV+VD7AiEwb:nsFkdBm2GWMuYEBq1O+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b3f1f107913147dde2a415e33231f19dc43f31257f4e2eab0c681f125cd4d543
MD5 4c3b0e5392f38593b0fc18109234bcb1
SHA1 e6e216ea42b22a7d2a8652b8dd97942324983958
SHA512 064b5cfde68b434c3318dd6e293c56f42bffa8668b5fa6bff583830000f088222d93219ea7b077eae13476d32b8715faad35f648677b698cecb35c8af7a87897
SSDEEP 96:nsFkETw1PX2wpvWMoiVmde1Qun1jkwosUWQyV+VD7AiEwb:nsFkdhX2GWMqunh0srg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 7d71959eda1f447eebf46dcc170c16f6c8b2d5f13470a2b3cd0982c4df3453e0
MD5 83f5561974bc49d9588716d1b296dc12
SHA1 86addeee54d735808943d93bea0bd8122621208e
SHA512 f6adf5f933e79079a67afd729a8a10bb5d608e84249df807599c738ce7d20341d82862a16c6cfbe4728ba6f7c02a2e0c3cc4e53ed0bf00ee056adae72b866256
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57bf68.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57bf68.TMP
Size 371B
SHA256 9b82c1ddd367004c861f7033361a7495cb8ccc1a4722a3ca3e12bb9aef380042
MD5 8b7e6de51883234033fecb6d5f2fd9d8
SHA1 95a026c780f9ca21d84a33968ad7df5522cad7e1
SHA512 1260d3202dc2e17fed764da3e6b0744355b1365585f007a9e96f62965da905b8a491dec980eef668397a705700f2adfa8ea38bc4b784b8f052904e7a401a7548
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3bf8564c043bc25588396cd7884ef86cf7b75626c65303611c39674239c5557d
MD5 4aa473f83577a89f6955cf2ceca0f0dc
SHA1 86697e8876b540abd1d06b8af7b8a6522cd4612b
SHA512 c8d321462d46df9b556fa9946507538458cf25434dcf44e57f6d977098955a93a80d79ebb3e3a3e0c3bb3aacddb0a14db1668b980472840500ff89163e9c45e3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvGe2RUoy4V9+OblfBhDaaW:A9iIxuERzA83h09RZxYAn9/XDafEB+b
MD5 SHA1 SHA512 SSDEEP

Submit Download