f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd.exe
Size 278KB
Sample240526-cbg3mabd44
SHA256 f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd
MD5 e75fc5496eb2f025dbf69572d337fc31
SHA1 1703909fd842f09ae0dd4a2811d0102058534ed5
SHA512 145d631261787e918bd12529504f7db71708ef07ae613d79776c671174f6b59968054068ef8f27e9618523d463faa44368ea800b58e46fb18857aaaf09fedf05
SSDEEP 6144:JJYZYzEn0zE/yoUQyPiL8a1bcGGGd+go8mb7q:YZ3aE/tU01v7
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5088	msedge.exe
5088	msedge.exe
712	msedge.exe
712	msedge.exe
3932	identity_helper.exe
3932	identity_helper.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 712	208	f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd.exe	94
PID 208 wrote to memory of 712	208	f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd.exe	94
PID 712 wrote to memory of 1008	712	msedge.exe	95
PID 712 wrote to memory of 1008	712	msedge.exe	95
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 4240	712	msedge.exe	96
PID 712 wrote to memory of 5088	712	msedge.exe	97
PID 712 wrote to memory of 5088	712	msedge.exe	97
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98
PID 712 wrote to memory of 2804	712	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd.exe
"C:\Users\Admin\AppData\Local\Temp\f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ffa87c346f8,0x7ffa87c34708,0x7ffa87c34718
    3⤵
    PID:1008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:4020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:1512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
    3⤵
    PID:3784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:5052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,5945959038645185506,3239357301026752110,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4764 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f4b844544f3f445e0ca74b3b28a702f6efd181820711ccdfea050aff64636fcd.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa87c346f8,0x7ffa87c34708,0x7ffa87c34718
    3⤵
    PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2004

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 55055a186c9f66e7dd36518578c67722982cbbf2ba196891fe865315d9fbb495
MD5 103318fd4613690484a9903fe31687ac
SHA1 86ef7da4ae2b0452be02f34e2a9d1589710d2d87
SHA512 7b7bc98bc4c76c8acf5c309e53c52b73ce35edaa5e35a69adc78340f1bd7b2054b851ffdcb248ed71dc4c9fce442f34925b66f6f73f10d543d74dcbf3a9d66a0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c0548efd8719992071402c8bcaab473ff7db2e91b218fad47568fa3c1c03464e
MD5 95bf9112b43d94cf40d3c421b5b917e3
SHA1 e019dc89bc025b1254611b19f63124f5266a5708
SHA512 24bbcd2037845d139d319f9a0b799c509ee3292914ccd0b42ac7fcfbb49478e34b69214ca96b61a24d45367bda7346f0d9b0a9478bd8dc14c07714d8a9839cee
SSDEEP 96:nfkco1JBwpvWMoiVmde1qu31jmirUWQyV+VD7AiEwb:nfkZHBGWMku3h/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 00d948ed9001fffd1d2232872dc7d7960f8ad3ebb49ec559ee12404fe36a2917
MD5 36193e7db4673991534d1faab03492bf
SHA1 35ab63af279c349853c35f13054f08f02bcbcdf1
SHA512 6823ffbddadfb96fd812a402d4b1ca87c48fb5949fc1c9f009c5869ef815f841a5a041d2968619658860d63c285ff75f5c36d28b764e155cf6936c8b5d3b8f66
SSDEEP 96:nfk5o1JRwpvWMoiVmdeHm0rUWQyV+VDCziEwb:nfkmHRGWMXvro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fa867a2901db16b598dcc4b677e748292c115dfb8b77090dae12e56b744bbf5c
MD5 43f61a5aac92cee6e0a2f69ac732e8bf
SHA1 c3bfe5d563ff05cb47c729672dea53d044fe16a3
SHA512 61a1c5251aa427454bdc4a21d62bda8ed6bd8718c1e7a5de40ef4448c54b4793f262f2f1c71604aed378faa49be15c553ce1aa63e65e3655b3bdb88479b11090
SSDEEP 96:nfkco1Z8wpvWMoiVmde1OY7MkdfJplO/UWQyV+VD7AiEwb:nfkZL8GWM4Y7BxIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 de4bc053c168ba2a1bf3b63f3a9e9e98cd283b8bd1db11d359423a473cb3cbd0
MD5 c3d0a17482db16b2c81cb61e66367f41
SHA1 6d973a5f782f6414a6375a67ebc5ee62eb568b75
SHA512 904992fe1bd808e5b483c0dc42781b2b32adecf00dafaefdcdda251c498c6faea279b63857742f08aa68c6119f5e0a9af7979d762703a7ecef837c1384cbce97
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57cae1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cae1.TMP
Size 371B
SHA256 86bc3da516e2325049589bc58117ebd6124dc4fa3ab00a100063a6fe43e1c49b
MD5 4a9b9fec736fb799da8d0d3855c23ac1
SHA1 9211e9db98ba9024ab57030f785dba9ec3baa683
SHA512 3d07b189793743cc224348e7b57ddaf4327740c195f1c31f013624af06d96484306a8292ffcd3040787cb452aea98060b17008f78ce1da0a7ecd4d5de702d130
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 dd7bf2b73c2b44cb24cb9cd7d02cc2385084bc29acc5baf0f86fd3222d648d80
MD5 d938c9da24e7a0731826a284d8892d87
SHA1 9bcf60a7047102300b38c84cd9a26bb3933a022e
SHA512 1269af4c0825ecad1ee70a2f9882c9b4d52280514b38e669421af04a1d1db147de570b0d603d7267f10757c0eaf4df33e6647c54bebd0ae95f59b83989cca718
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupv9e2RUPezr3z2OMDCRHqll:A9iIxuERzA83h09RZxYxvraOMWRHqlWS
MD5 SHA1 SHA512 SSDEEP

Submit Download