10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db.exe
Size 278KB
Sample240531-bvxrraba85
SHA256 10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db
MD5 7f022efa27ff3f5a630cfa800e64808d
SHA1 9ce8e6e690c15bf37cee98bb0f57cd2e5a40a0be
SHA512 627e3fc8ae733aa90478c52c42046aa0f418673a6b2793ffbfe573f29baf1e4f571bab1c3add78de4eb6acd82b70d5c17e75e2cb8600e46795caf6e2526689fd
SSDEEP 6144:xztV3H/SBR6/i+TceA506d8WwDdvakFICg:F3H/8R6q+TceA5UDtagg
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
752	msedge.exe
752	msedge.exe
1972	msedge.exe
1972	msedge.exe
2668	identity_helper.exe
2668	identity_helper.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe
2160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe
1972	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4524 wrote to memory of 1972	4524	10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db.exe	86
PID 4524 wrote to memory of 1972	4524	10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db.exe	86
PID 1972 wrote to memory of 4264	1972	msedge.exe	87
PID 1972 wrote to memory of 4264	1972	msedge.exe	87
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 1384	1972	msedge.exe	88
PID 1972 wrote to memory of 752	1972	msedge.exe	89
PID 1972 wrote to memory of 752	1972	msedge.exe	89
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90
PID 1972 wrote to memory of 2740	1972	msedge.exe	90

C:\Users\Admin\AppData\Local\Temp\10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db.exe
"C:\Users\Admin\AppData\Local\Temp\10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa082746f8,0x7ffa08274708,0x7ffa08274718
    3⤵
    PID:4264
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:1384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:2740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:3280
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
    3⤵
    PID:896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
    3⤵
    PID:4028
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:2320
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:3092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3184 /prefetch:1
    3⤵
    PID:2656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:2108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:2444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,1236558863998301546,14836760944514449911,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4732 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=10d109eec0696eaa976a8c902505d948df0e739fc6f95bf24515bdf81e0897db.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa082746f8,0x7ffa08274708,0x7ffa08274718
    3⤵
    PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1444

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 3ea50b8244ad19a509623816278a62f05def3d8b4dbe71731ec991229a573f02
MD5 cfc12960c8ae34f8142db7919a852bc1
SHA1 58c24173c96d81b267d9e943b2b25d8948a4298b
SHA512 3246f952e26207ace412470cb9adeb2da63f6189b482e8c91493826dc171fa1206078b0aff0d2a90d3979dedfc7433519fc5e5b72c34e9de0cc6ab80e8b05d25
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7cfd7fc5f85b0d76bf7bc361a61cd81792cdd2c9ef92945ac544b37e04fa6e32
MD5 2551c100951d442f1456bc4da1778d41
SHA1 fb61168599bb1d11f1df92d98d000a724f76de4f
SHA512 d637c2907a9b2fd26e20e6c60c741c931ed5eaf3aac1a0e7bc96c2dbf1553b40fe24025ceccbc026d26d1e5a9cbe42775286a33a8d32d2957086b61edffa3e46
SSDEEP 96:nhk0610D2wpvWMoiVmde1mu61jkqWUUWQyV+VD7AiEwb:nhkPWD2GWMIu6hoUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d1ea5d5a2ba1bc56d8bedc20e96463613d34ce26482c4f83481a07a40ee85090
MD5 351012dfdc1210fa23090e5e0db01dd3
SHA1 8029773b16cc8c35d567c9745292874588eb4e1a
SHA512 af86675537b1707c6dd2b81d0066c04b982140cda5ceb5de9c79eab9359f28d769948800de84f9d7449a61bbe280728f5b824f2142c82150c77f57efac2e097e
SSDEEP 96:nhk061QS2wpvWMoiVmde1KYKMkdfppbSWCUWQyV+VD7AiEwb:nhkPOS2GWMIYKBxlCrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 7d5f94ed18300150a23f7a897d3ac5a3bf1a11a41dc064ba9bef083db01f4a90
MD5 32c1f2bf2d2737a7f1724546ad71e71c
SHA1 efe79852e2ffc54471271462377d6ef724b9a264
SHA512 fcf309917d3302fbff5c38b77cb1ab655c452ef87b509266aac6b2b3f57a0ee68d30f5c3fc37cf59916e6b8a39b38a3813019b465ab47040d6f8ee9fd4bc66d7
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c19a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c19a.TMP
Size 371B
SHA256 84c49af41b3d570877115e5d2e8c68e5d54e8ce1075c8ec1427716f3d2f4b417
MD5 7120ebbc60343206d702e4aff17ea9c5
SHA1 dd1d9befedfa78ea6c3dca1e24d25124af2edf2e
SHA512 e9431ac10d9f45eaf5599524d2827bcefaa4da0ce561a0f401f52791075f2f8d6fa938c5de6f29ff15477395eb27fb20c629fb478898066e2b3ef12bd5f8bd0b
MD5 SHA1 SHA512

Submit Download

aac8e7a7-f52a-41f7-8f57-3776fc531f0f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aac8e7a7-f52a-41f7-8f57-3776fc531f0f.tmp
Size 5KB
SHA256 73601e6041820d1f6a33a2bed0c8ecbc5eb759e4330b8eb9652254bda2217d02
MD5 1ee7a9735a62ebfa6fb7cf93af55c8ab
SHA1 363a7ec62aa7d61e0fa13fee84ee3f20745dc046
SHA512 8e2219837569c43b6f5954df5390abcb60a8739b0797bea5f843fbe2f7e87e6a8a2841d2efcccc5dd55081dd452f64ed268fa6fe2ca4103cfa11f9ffcd3f3058
SSDEEP 96:nhkR61072wpvWMoiVmdeHk4WUUWQyV+VDCziEwb:nhkEW72GWMXoUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6511a9d50aa5feae297bd702a463ce2cea546cb54c140a12161d6debe95ed9d7
MD5 0257491cf675c36f8abe3578ba4725ad
SHA1 93f86639ed92eabff010cb1f11266310f1e50756
SHA512 0f9a0ea0727ecdc4c2ebd6c6c13a58d9dbc17b2b4c43bd86e471f4874a3973c365a761e92bdc7a00d0e15b25a9f7e0e22ba4c7d8ada0dedba1c1195b3e04c8d6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupe3e2RU1Ky4V03z2OMDCRHE:A9iIxuERzA83h09RZxYU30aOMWRHqlWO
MD5 SHA1 SHA512 SSDEEP

Submit Download