14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d.exe
Size 165KB
Sample240527-bt9d6acc83
SHA256 14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d
MD5 34e4b2093cc1045fcd29c3567942624d
SHA1 6eed37b3bf7342042b0f7ef36e78cf686e282352
SHA512 cd73c08fd9d1e0afa6fa602a6788c3d4ce0127cb6521d0d26b9ae53acf9fa7b25a986faef29a1d1dc41b5dbe8289f03d929f3ff83fea499d1fed72dd9a39a6b2
SSDEEP 3072:bYyQIjxaGrHJ9Rf54NrcdD4q5RSnR+/TPKDyyjuZ8y:FQkaG93f54aaq5k+/ryu
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
632	msedge.exe
632	msedge.exe
3436	msedge.exe
3436	msedge.exe
1036	identity_helper.exe
1036	identity_helper.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe
3424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3436	2552	14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d.exe	89
PID 2552 wrote to memory of 3436	2552	14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d.exe	89
PID 3436 wrote to memory of 3132	3436	msedge.exe	90
PID 3436 wrote to memory of 3132	3436	msedge.exe	90
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 3084	3436	msedge.exe	92
PID 3436 wrote to memory of 632	3436	msedge.exe	93
PID 3436 wrote to memory of 632	3436	msedge.exe	93
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94
PID 3436 wrote to memory of 1432	3436	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d.exe
"C:\Users\Admin\AppData\Local\Temp\14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0xd8,0x104,0xfc,0x108,0x7ff9813246f8,0x7ff981324708,0x7ff981324718
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:3084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
    3⤵
    PID:1432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:2692
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:3180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:1480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
    3⤵
    PID:1184
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:2192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,7075280857067281432,10418958767673845841,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=14b59418593e4def07b6ba58cb362885337d9605d843448dc6b2037962a3b65d.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9813246f8,0x7ff981324708,0x7ff981324718
    3⤵
    PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

2b79324d-3af8-40c5-bfa2-ab0ca6547e13.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2b79324d-3af8-40c5-bfa2-ab0ca6547e13.tmp
Size 6KB
SHA256 5a7d6c5111cd16aee5c38fc03e2c72e68db62969b09f4b90b8ee557b34b7e674
MD5 d2e9d970d4811a416e63ec0e80a3c3fa
SHA1 9d9736efe18068bfbbae1c263dd7dde1723fdf17
SHA512 8a84c939319453abe5da63aa24f188c55b19182c97325e0668f6594f0dc294d58a2bf261c191251338e445765b9c41c88d6892557c844793e7c6f9faa465a675
SSDEEP 96:n7kTD1FS2wpvWMoiVmde1aYHMkdfJpbyR8UWQyV+VD7AiEwb:n7kHTS2GWMkYHBhu8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 a6664503602284a8f3ed30b46ef9964b8790ebad77bfd0c22f08b0123da9f61f
MD5 39de48a1f33fd6fd758bfbf58db5f8b3
SHA1 36bb82a78c5775f6678f93c1ee0f770f6dfc84b1
SHA512 7216d52f36769f50d3fde13ed49abfc204e67fb7e5f575baaa1e9ced07869a8bb24a3cd93aa6808abddeae1bd7545abe2e5290f73da3c723d5dc6fafea24da76
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3aaade42dc5d4d0c6dcb4cb2fcc19c20d125ea7f90b91a672a5e92bf6dbc043f
MD5 3c9692669a0f51051ccf55a9aefae9c7
SHA1 cadc3d7ecbdf6f65e6530caf1178b753c2a3ff3a
SHA512 4520a81b27d43c98c9b9336d50ad6bb38d852ac08d9c448ee3bf5797c73b64ced338a0cb2dd9b93d66b9553aed852c6e842d130090c28aa6b292415a49eb38ac
SSDEEP 96:n7kkD1N72wpvWMoiVmdeHk4R2UWQyV+VDCziEwb:n7kyf72GWMXX2ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 75e16873ab38350ece8b5be9de51bbc9d05a18d2108fc31d3f01639476bc2f9c
MD5 1c077482e300efec453593369277822d
SHA1 0bce77d4eeddb962c9ebc8ee05b1051e8be5de81
SHA512 c12a8c2270a9edf3b4c9b97f349b54148700a91d00d1d911fed12d3458ebb3e88230561f9fa50f3539d06448225b007cdaba26322aa6a7fcf7ef19e33d33ecec
SSDEEP 96:n7kTD1ND2wpvWMoiVmde17uk1jk/R2UWQyV+VD7AiEwb:n7kHfD2GWMRukh+2rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 98dc734df45d0a6d686582210503101749c423ad855102f3d8ca27e6a2382915
MD5 423487f4a3af05a0ee3aaccb6f8e442b
SHA1 a953bc4947a5e19e4d3b69e7f4d0d6695b243ba3
SHA512 285f4acede46eefbc26025c0f6d4b42991b66511ef890c314a31f3f17d033329d7204cc8f8b30a7badb5d51c59bd8c471db90e85d88cc9084b9d04cf0bbaf52e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b4e8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b4e8.TMP
Size 369B
SHA256 72f0ab9aa10a51d2cb137b06c14bd16da317c5d766374fbd045f520f85c0fac8
MD5 9eadd9d98bc8e111ac6e52a4342f23e5
SHA1 b5dabb7df814da5523ff6cd7773d83c54d07abdd
SHA512 1cd36b7f7bfb2101e3acbadbf4c27ee96eb6d3f89614af62454864c30bc8a4c65d9a7ccf6b7339effeb0933a340e95b172bf13f23ac278930ff4b3ffb87e8cfd
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b1f0ba11f6cce7dbd40de16981f07d3167e53ff50f2a8b6fa2595d958c7f52c1
MD5 b088aa042b186ece7d077b914517b789
SHA1 4e98db528a8a7dc7ebe536d18a3e22023367809a
SHA512 d6d8ada47ca40e26306dadcffa1318f4a4cc79099e89e15c711e84033c91c4827c489b6f913b7790bd34d8501d444c43778c4939e6c4a882e8da7b03a7530c90
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupufe2RUNy4Vh3z2OMDCRHqC:A9iIxuERzA83h09RZxYgKhaOMWRHqlWr
MD5 SHA1 SHA512 SSDEEP

Submit Download