f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437

Analysis

max time kernel
147s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437.exe
Size 167KB
Sample240526-ctxk2acb69
SHA256 f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437
MD5 7b8bf33082a85fa5dc2d34864c7ead3a
SHA1 cd3d7ec33467a6d2c47ec67a3069605eb0204f33
SHA512 e31e050edf581291c2d5c7ecf3a1f57afe97a373ca68d749bfb01a04b89320748e666b41465562c04bed399fccbd0897e60a4269a88c53e7998dc6455591b75f
SSDEEP 3072:tOvmgWk5S15mOreF7LyOkN9nkEwmx7bNWHlVYHVVUUUUVnV3XLjIlID69LXKaaUg:tgmgn5S15mOreF7LyLVkMvhqLXKuqLDO
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5004	msedge.exe
5004	msedge.exe
924	msedge.exe
924	msedge.exe
3600	identity_helper.exe
3600	identity_helper.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe
3656	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe
924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 924	4768	f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437.exe	96
PID 4768 wrote to memory of 924	4768	f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437.exe	96
PID 924 wrote to memory of 4884	924	msedge.exe	97
PID 924 wrote to memory of 4884	924	msedge.exe	97
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 4728	924	msedge.exe	98
PID 924 wrote to memory of 5004	924	msedge.exe	99
PID 924 wrote to memory of 5004	924	msedge.exe	99
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100
PID 924 wrote to memory of 2348	924	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437.exe
"C:\Users\Admin\AppData\Local\Temp\f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xe0,0xe4,0xd8,0xdc,0x108,0x7fff9d4146f8,0x7fff9d414708,0x7fff9d414718
    3⤵
    PID:4884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:4728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
    3⤵
    PID:2348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
    3⤵
    PID:4528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
    3⤵
    PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:220
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:4004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
    3⤵
    PID:336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,4139691907316396542,7541279746503804557,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=f62d3d110595c2db95a9c74c00223dd48e59cf597818a83fafc06373f04f9437.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff9d4146f8,0x7fff9d414708,0x7fff9d414718
    3⤵
    PID:752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 f4f9f928cdf4708810e48d4d531e271b03d1130367fe7927e59563d227e226d6
MD5 2cb381055ae9ead5712c97b726ed88f0
SHA1 298b72f3f1074e1562bf69a8548418a766cd56c7
SHA512 3641e6f86fd7c94fb0d3e6a3b1dc30f74f8f702e7d17532a189d712bb05d03b40934bcf1260b88def7c4e7478280c02f142ca8b0298bf69ed4cddeb3b4ccb651
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b47c9429d8ed934f15d5924b168f8cee3b43f36add6aa523caa1e367863cbbad
MD5 6e81d157b0879fbc21b4220463c82975
SHA1 ba5e4112783ee9730ba5ea94e372256b561286d4
SHA512 add2a5022d35d77c8e5ef40fd6991192b1bd33718a7c46a80adb32f27a0edc10fb49c30785b32cb3ab65ca7b04f44da4ad64b366b138f23cef14fb365d1e1b4d
SSDEEP 96:nBk5q10QwpvWMoiVmde1OY8Mkdfxp6rf3rUWQyV+VD7AiEwb:nBkc+QGWMoY8B5wrrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3ae1f281b12a1ba8873f36714719b70fed80e59f050282ba52f8dd32e5a7c8ea
MD5 8b9febbe49e960b6124512274778ee61
SHA1 34e65aa73db4a0b64cc131a6beba9dcc927a3ac4
SHA512 8034461ee2b09b2743d99f2e90002781c507b2ebeda1d571ed51a9ff0f86ef7a0e97f598366864ab7b70e10b5983cce9cc31081611d12ddb5a04579c6c9b37af
SSDEEP 96:nBkiq1A1wpvWMoiVmdeHBrz32UWQyV+VDCziEwb:nBkJm1GWMXJ2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b958a7f922829c0f98d94c6680c439e9c7b2dd79a8cf58e1815088f4a9a5ebff
MD5 6d0d4dd65f322e026f7a77f4919737b7
SHA1 a0f9c81cd0270812dec0f0b18c87242feaafa25a
SHA512 aa2cd9349fef0dcc764e703f01fdf725de9418682c7740ce4ca69ddcccab171bfa1b3470525d56ffe65da3c88d395aa1d0d45e3380e81176048867e74cdbdf86
SSDEEP 96:nBk5q1AFwpvWMoiVmde1Duc1jBr+32UWQyV+VD7AiEwb:nBkcmFGWMFuch82rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 953a69cae173f60e596c87a5f0af46a4a82d78f2e3311c1822ada1111530f427
MD5 8105af905a265eb556162a34606e6fd4
SHA1 d1474adcbd47459d3c7488757837520a6d447875
SHA512 682fbe89969260dd8d09114ff60824fbffe61ea7ae6907ba523138602c8784835f685f041bd67df63432a9e3efa26309dda7eaa0ccf838023be2560ee4a68a1f
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b6fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b6fc.TMP
Size 371B
SHA256 4174928a3f53dc3284f0ec8e17c381ce79de00d4ebe191a711159d8da9ae6839
MD5 f4c4f097c5ebf0052775af27c5a8167b
SHA1 e0cfd8d1fad19b0129078b5e10441b33bc329c12
SHA512 67c1c0d155482be5d60432f1a251909656b1c49a49bada53389f8835aef10b9725d4ec8deb88bda7a5b36b9b2cbfe4fa0b1aa8b77fe64996bfb810d9a30b8518
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 273d98ddf92b628e6d8cd0d42ce2ac1344d398fde814c80a611caa22aef0a3ed
MD5 147cf53c47f01a475727e9bff21e9d38
SHA1 2f6f58caaa007b07ba49ac7b381e0c10f2a7673f
SHA512 1e4105fda22ee3ce3e1cc5f3dafcad5272691068f8ff2e4495756a967733f1f8e68cf5215c2e53d28a51243f59dc54ebf7ad56d3cef63a083b464e249e7d4028
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaxlHdJe2RU0gMj2TE3z2OS:A9iIxuERzA83h09RZxYmHL7yTEaOMWRI
MD5 SHA1 SHA512 SSDEEP

Submit Download