674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f.exe
Size 166KB
Sample240526-bql5fsac72
SHA256 674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f
MD5 5da4f00c6de5b865ff10c21800831193
SHA1 4ddb93a78ea14e658a08570161fa36726bac6f81
SHA512 332dc060946e5d05cc3eaf3982db2dfdbc57d6694b74f099c5dbe25997841afab87d765e583a11c7d35ed829a9e67eedceb5ccd84cd724597c74a423195df20b
SSDEEP 3072:YU/TjIRIXZd9n5uPsTKCPoSJsQuTkjMxLaK8yJDV6U0/SY:YU/TjIId9osT1PfsQfI1aKrNiS
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4948	msedge.exe
4948	msedge.exe
4320	identity_helper.exe
4320	identity_helper.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe
4948	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 4948	2964	674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f.exe	94
PID 2964 wrote to memory of 4948	2964	674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f.exe	94
PID 4948 wrote to memory of 536	4948	msedge.exe	95
PID 4948 wrote to memory of 536	4948	msedge.exe	95
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 1872	4948	msedge.exe	96
PID 4948 wrote to memory of 4036	4948	msedge.exe	97
PID 4948 wrote to memory of 4036	4948	msedge.exe	97
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98
PID 4948 wrote to memory of 1704	4948	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f.exe
"C:\Users\Admin\AppData\Local\Temp\674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a17846f8,0x7ff9a1784708,0x7ff9a1784718
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:1704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:2556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:2996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:3888
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
    3⤵
    PID:5348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,1505488261441827365,9630922689963106734,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2588 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=674d852b4c3d834f4770af93e4ea15db27c24b08f728fa7c832aadd9c94dd08f.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a17846f8,0x7ff9a1784708,0x7ff9a1784718
    3⤵
    PID:5296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2976

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f
MD5 537815e7cc5c694912ac0308147852e4
SHA1 2ccdd9d9dc637db5462fe8119c0df261146c363c
SHA512 63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513
MD5 8b167567021ccb1a9fdf073fa9112ef0
SHA1 3baf293fbfaa7c1e7cdacb5f2975737f4ef69898
SHA512 726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 cf6a0335221ac6d37690d70bb1758641d7c333b9586e916c6a7992b7aedc989d
MD5 f09bf70af845dae4e586f8ce96266a19
SHA1 e58d612d308851a54b805522e649dbee4768cba7
SHA512 1c97e86f9aac59882ae6deac0608538c32e5c65f91196a92600ac8676404ff8c89dd6cc359872964dac4ca71d1ff4115c6951ba31d950337c6e26225baf2ef57
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ae1b2bb9c2b0a5e2c0c70664a68a9641f8efc275c524d73f81163706cce5532b
MD5 f77faf7f405547dede54f4cd9c07bac0
SHA1 5c7ccadfb90fc26c778e9995ad6d5ea9c85970cd
SHA512 c2f2365cc3519dbc44206fc11b275a0eeeb0fca4c6113ad7df1d61a0537ebd6600d8c6ce7eb41800f4c483126cdd4a0b33ea3f2ef6222830b1929f0fbec53d8a
SSDEEP 96:npkcM1bC9wpvWMoiVmde1MYXMkdfvpyRETx0MUWQyV+VD7AiEwb:npkdZC9GWMKYXBngI0Mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fe8d2afef3bc7c66f291d7fd5af9d31aadab33cd761e7ce460a4b2a556590f77
MD5 af5c4ba25d2828d09e7b0d4af98642ea
SHA1 175da0690d03437d40c7ed0ce660d21e70f4fc29
SHA512 c6774facd547781a6e508dd42b7887574ab3a26b8750b016d4efbf0ad92f806603dbd4256f29042d8f71de9b2f8a4c4c1195bb2d313fbea0c14c66f4e664887f
SSDEEP 96:npk5M13D9wpvWMoiVmdeHpRQTx0tUWQyV+VDCziEwb:npk6JD9GWMXpk0tro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 78c8af1e67736caffe0f1887b0b4c6435b8f49c42b1ac3a81523226aa7d8210b
MD5 e8471576afa912b876533bd400e460eb
SHA1 f994d098a8a3842d7a4e3fb42a96abc8d9e3fc19
SHA512 c0d3bb7567cb00f400ed88bf36abbb12bacd3d111824571b96b5953d691f3e5d0e9986a79ede1bfef2ed335bdaf80ad9b7801d729edd8f6febd1c701cda283f7
SSDEEP 96:npkcM13z9wpvWMoiVmde1Ku11jpRKTx0tUWQyV+VD7AiEwb:npkdJz9GWMou1hp20trg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 79d4effe654c15862b7bd1e9a1ad828fdc012a762980183fe1fa04cefd6425e7
MD5 14354705b6bb4a8ba46c3b14869d151d
SHA1 288ef747f93cfab77c9a1717cc53ba1721cca8e0
SHA512 c3e47c38aba41ccb5ce8665635e3ce4c27de1d6bb7ab01200eca9f058f1733b82e7d7fcb74dd64e81f4fd3469840faec9039bd908bac766bd23650270b216333
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a1ed.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a1ed.TMP
Size 371B
SHA256 2cee657a07b6b7a2530f9e2a5df414ebf7a29f084fe4920631bf8310139b44d3
MD5 d58abac917d18103000f442aaaf700ee
SHA1 fa792c75fb91f6836b6d86caada03471eef0f7b9
SHA512 591d18f09a5f809b20575c5ee40772c4598f8efcdb29ce2e3c97f359515b4b1fefc26d567f5710e832e57bbcf57d144628e337595e67bc6aceb277377d137741
MD5 SHA1 SHA512

Submit Download

a152eb3c-295b-4c75-a51f-bb5c04302767.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a152eb3c-295b-4c75-a51f-bb5c04302767.tmp
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dc36aad23efeafdd39ff910511bb96d924c7960afa5cbd77c22eb06254655fc5
MD5 fae8f3ba2722ab204a82557d0b361e83
SHA1 7071fd86100c2fc9a18182f38e83fce931e393a1
SHA512 e145568e0087f795405c9ddc8e5161bc074f2ef31c9a547b18baa7ac1b9cd155fcf0d030e83f4aadad7ea64e1d3cfddd0ff2d4467a386ec3822936d8a54a2e24
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZXe2RUe/qT13z2OMDCRHqJ:A9iIxuERzA83h09RZxYZffY1aOMWRHqJ
MD5 SHA1 SHA512 SSDEEP

Submit Download