f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1.exe
Size 160KB
Sample240526-brplzaad29
SHA256 f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1
MD5 66c8d3ad7bb1cea467bdc77f432bf266
SHA1 36f4aad51e8640765430ceb4cf749a62d0d42faa
SHA512 2228bf8caf87f491851f2b33d60e64bf365ebd9c83aa54f71eecdc2275849846d17733875cec5b3d1d201e89d7c16cf095fb9b4932159e8ee56289ab5ea80047
SSDEEP 3072:vtzwV66pzMZnT9TPYjThxCUW1IZKLDYLhdFQ05nTMzY2wgntVxiGU075Wk:vlwVbM/PGXCUWisPFUnTMzY2wgn9n7
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
812	msedge.exe
812	msedge.exe
4700	msedge.exe
4700	msedge.exe
1976	identity_helper.exe
1976	identity_helper.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe
5444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 980 wrote to memory of 4700	980	f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1.exe	91
PID 980 wrote to memory of 4700	980	f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1.exe	91
PID 4700 wrote to memory of 5712	4700	msedge.exe	92
PID 4700 wrote to memory of 5712	4700	msedge.exe	92
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 5268	4700	msedge.exe	93
PID 4700 wrote to memory of 812	4700	msedge.exe	94
PID 4700 wrote to memory of 812	4700	msedge.exe	94
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95
PID 4700 wrote to memory of 3980	4700	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1.exe
"C:\Users\Admin\AppData\Local\Temp\f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9962d46f8,0x7ff9962d4708,0x7ff9962d4718
    3⤵
    PID:5712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:5268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:812
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
    3⤵
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:1652
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    PID:1064
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5276 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
    3⤵
    PID:4496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
    3⤵
    PID:2144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:5908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:5384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
    3⤵
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
    3⤵
    PID:1072
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,15384498896943655413,15986358982554603912,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f6aec20ee2bb42d0e5072d4ae5518c8b7cb9805c2389da0193a4b25abc21b4a1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3760
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9962d46f8,0x7ff9962d4708,0x7ff9962d4718
    3⤵
    PID:3768

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

71944a23-a031-47dd-8793-4dd231ebe99f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\71944a23-a031-47dd-8793-4dd231ebe99f.tmp
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 e7c034fcd8ace48bd04eff6d31c5e46bfce197bfea1f33af54b1f5e79c57d8f4
MD5 c497085e7c06de4ffc7e15a51f3c32b9
SHA1 a15e4ea3f10acb6f9d477ad56b0d28302099f7a2
SHA512 b9fe57a1b8ae14a15ffaeb087fd937237cb06aa6b8c4b79215916ede63bc602e96051ed960a5db70db1d1b35228a40e69846e204ed1b707b53a94b988e630a8f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5d4b808e74e4f29b67ce84969c82b20aca18c9587b491f7af088a4b065745f24
MD5 f3196d99ce3b234f71f7f4f11e46f36a
SHA1 6168e080e61c83233de86a5a17c98a6eccd24aa8
SHA512 56c2701f9d46b82c51ae180dfb9afa914c1b8ad3393f3be42e70b9a741b788a9081eed99b591d8611e22deb830a8dcb0bb76aa11d8893e5f4f8038ed7949ce3d
SSDEEP 96:nvk8tp1aO3wpvWMoiVmde1QYAMkdf7pylwzAacMUWQyV+VD7AiEwb:nvkCcOGWMqYABTgtXMrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3e550c4de1928ee8ec9ae5f6dda778c2212075260e9b34ab38ea83164e7a3966
MD5 fc205e01abe7352a14390bb63813ed03
SHA1 eb9189e59ad030429fa2a4073d96ff626178ee88
SHA512 abc90a1b474f63d2c310186060a2b5da41ecb46c1f7e01148c21c27e669fbac1052871eeade133ddf78f6538b66dddc0c0548a9afdfb85876382fb29610acca2
SSDEEP 96:nvk8tp1Kb3wpvWMoiVmde1luW1jplwCAacUUWQyV+VD7AiEwb:nvkC4DGWMXuWhp4XUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dba895eb7a6a6222a6e3af58e96d54ed987e05ad5b2f2cd40d4b24341ca33544
MD5 e1321fa895bb9b2658804e18ba51d6fe
SHA1 5317243795de45047eaf9375653e7127cfc3672a
SHA512 0574f017ea289ef118ae61c7a50f63a9470373a9243ef584f64c7c475b5032120da2d86c29470f0e6b4187e784d94b8d7da7432fd9c9e2ad3de380c67d8b7a62
SSDEEP 96:nvkZtp1KL3wpvWMoiVmdeHplwtAacUUWQyV+VDCziEwb:nvkJ4zGWMXphXUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 e211d1850e3311f518bdcc38e667467ff0dc32e58c7afeae45d206642f2fc216
MD5 f823fc60ab84f40e2ed659a3f9cd8838
SHA1 7137dc84218df7a6d06c7794cf0f2feedc62ab90
SHA512 e5941c2c661a1b38944ca68583eee986f2d25896bfe3a199cfbc54fdc1d102502ff553491e9582c8255e51ec9090787d248521efcae8deb40c342210f25b2112
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ad86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ad86.TMP
Size 371B
SHA256 3e0c15579599d24d8b9504a86a9654ad304c7ff9e4520a01ed5f93a0b4a323de
MD5 8bc07f6e28171a58d00916d749ff5992
SHA1 0b05f2acc527d405299e84cfbe5916a99bd169a1
SHA512 ea5f2ac6f85fc997244bf60a31c6415c1a5d92a75c32676a5ce335fa0b3b8bfc7d6cae15bab07567eb6f8012dcb8b08f3e6f00633f77ce60a4bb08cc3e63d120
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 5702a43b2d08bd0e48e30683bbdf1bd67aacc0e48b8095b5d74fe74bfa92170b
MD5 0091491b987a05db3c683059a442eaaf
SHA1 278ecb2111a1558571c37872f66da6044d1c1ed1
SHA512 44c7f53b39a8a6827ed0f2e45b78df65e2c3a5afddad72b55d07c1d56d24d04cd769c8d7f92bf4a2341c038922afce1a0273fb736f3a9cb6c0cc4b23428c42dd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJre2RUG2Z7L3z2OMDCRHqB:A9iIxuERzA83h09RZxYZ27LaOMWRHqlT
MD5 SHA1 SHA512 SSDEEP

Submit Download