3067c3c964603a362eab4366d451f8a1872e4fec0b683a340ddf862ec8914b62

Analysis

max time kernel
138s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 01:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Lisect_AVT_24003_G1A_46.exe
Size 3.4MB
Sample240725-ceefxavcmh
SHA256 3067c3c964603a362eab4366d451f8a1872e4fec0b683a340ddf862ec8914b62
MD5 2fc294ca0c0c3cf7a72515dbba18b52e
SHA1 6a30702c73e9a8a7f3a370673078983189697ff1
SHA512 f33ec17cf326837d91dd4266347fcfb62a09cfdc75b4516d03d3e8b3205bb5d0e5ada667c16248c5849c77cdc66e81a705ac125d485d43e38d2a3e8799d580fa
SSDEEP 98304:Rs9b57LSoQFlXZygbmhFZdhVneeUdo8Ac:El72rvXZchhDUa
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3200	msedge.exe
3200	msedge.exe
4832	msedge.exe
4832	msedge.exe
4848	identity_helper.exe
4848	identity_helper.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe
4832	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5072 wrote to memory of 4832	5072	Lisect_AVT_24003_G1A_46.exe	92
PID 5072 wrote to memory of 4832	5072	Lisect_AVT_24003_G1A_46.exe	92
PID 4832 wrote to memory of 3068	4832	msedge.exe	93
PID 4832 wrote to memory of 3068	4832	msedge.exe	93
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3220	4832	msedge.exe	94
PID 4832 wrote to memory of 3200	4832	msedge.exe	95
PID 4832 wrote to memory of 3200	4832	msedge.exe	95
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96
PID 4832 wrote to memory of 4904	4832	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\Lisect_AVT_24003_G1A_46.exe
"C:\Users\Admin\AppData\Local\Temp\Lisect_AVT_24003_G1A_46.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Lisect_AVT_24003_G1A_46.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3ca746f8,0x7fff3ca74708,0x7fff3ca74718
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:4212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4928 /prefetch:1
    3⤵
    PID:552
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    PID:1280
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5324 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4848
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,15851263103797291494,6344380470287147000,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1800 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=Lisect_AVT_24003_G1A_46.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5084
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3ca746f8,0x7fff3ca74708,0x7fff3ca74718
    3⤵
    PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5e3237f26b6047f64459cd5d3a6bc3563e2642b98d75b97011c93e0a9bd26f3b
MD5 eaaad45aced1889a90a8aa4c39f92659
SHA1 5c0130d9e8d1a64c97924090d9a5258b8a31b83c
SHA512 0db1c6bdb51f4e6ba5ef4dc12fc73886e599ab28f1eec5d943110bc3d856401ca31c05baa9026dd441b69f3de92307eb77d93f089ba6e2b84eea6e93982620e4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d80ec29cb17280af0c7522b30a80ffa19d1e786c0b09accfe3234b967d23eb6f
MD5 3ee50fb26a9d3f096c47ff8696c24321
SHA1 a8c83e798d2a8b31fec0820560525e80dfa4fe66
SHA512 479c0d2b76850aa79b58f9e0a8ba5773bd8909d915b98c2e9dc3a95c0ac18d7741b2ee571df695c0305598d89651c7aef2ff7c2fedb8b6a6aa30057ecfc872c5
MD5 SHA1 SHA512

Submit Download

30d448f6-ff43-40dd-8bbe-27674901e074.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\30d448f6-ff43-40dd-8bbe-27674901e074.tmp
Size 5KB
SHA256 8f71ab681acd8afc2311ff94b36f35a8a611772faca0b7616653885cd981e246
MD5 d1f057d01b24cf94ce54ab3a31a24bd6
SHA1 2b8746c827e1c3e5ec4e9e9045731d027622a5a3
SHA512 f45c00b81b66d600e605ba07f88f76ef038ea50d1997180d38f7953ab7f01c43206195de1fc9d50b1d3d6c7176689087008569c1a611cc9283b542270799876a
SSDEEP 96:nrkOB1Ld2wpvWMoiVmdeHqmmTJUWQyV+VDCziEwb:nrkCNwGWMXYro
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 0dfed24ceba0188c8d045777ced49e7aaca1842dd59b85be730baf1f2aaea006
MD5 4ef3560c2d9b63a304eb8d566ffcb5ae
SHA1 d11a4118c12090bee204d8fe21f304025353df36
SHA512 8cde7872455f5f437c6ee082498b0e93fd64c6d5a3d6aa8fd5a0b830416a79b8df45a1e88a42db9a47faaed9a68845cfd7da2e8a4c88e40744b351f15aa99ec7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 872a5a9d52cd84de82fea2ec536949b627767b0b462a66012cdcc2439754ed24
MD5 8c9f868e16134f7b16fca2982b43a0fe
SHA1 4cd510dd17df6a7a2d80bfccd7c0c52134b92987
SHA512 d241f945bc62a4d35cd0961ae9cea40e5b57c16e92208e432bdeefde0018befc323c7a4c7814c337eaabb24aae77f600d158d74a7bb0c42c9267857dc8983d0e
SSDEEP 96:nrkdB13e2wpvWMoiVmde1RYGMkdfOpNmlFTnUWQyV+VD7AiEwb:nrk3FRGWMXYGBG+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9486937e6aa8a321bedc81056ae13a06b03f19db229fc83e08f42e445c4d9108
MD5 eed8ef66c6600db2e723b299958f1671
SHA1 7b27bc2a9e781b8e009218d8d31a63791b75c212
SHA512 1f7de773fc77472a395418a38e53b262ba7e76e508aecba3f6bfa270a1fdfddcebb8c6ef6a69d868afdbc2b27c42d40f4837a273754b6a09b12986f5f3cdd08e
SSDEEP 96:nrkdB1LV2wpvWMoiVmde1DuV1jqmxTJUWQyV+VD7AiEwb:nrk3NIGWMBuVh5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 d323fc78fee60215003a71f708536b5f17f7271cf566ccabe10d13a02946604a
MD5 198b3bd3b05565383b7bdd0460726296
SHA1 d3bf785c761c67aca7ad4c229ee9dd9601ee35ae
SHA512 481989007feaf0b74f0782740f82724b0118ff3f82d6bf06570eff8a2ee2b65e8c81d3e75d8d00193aec1ae02c1f0646077b5121c9aeb59f195fee46297a1b20
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57e918.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e918.TMP
Size 371B
SHA256 5ff6a80faabaaa818a0a0c2506023cc2eec8e07ac8ce031b8364bef0ac0c656f
MD5 ce4272035f32ff29bde5764fe90384e0
SHA1 41e474d21f39b255dc798638c6ee5ad4728be822
SHA512 2913ef9721fcab7e6e010a6cb893209ce97a38dd1c8be4de4d7f0b51bba362564fa0393d9d71b6f14efd1ccec80ff8c93bd4b7ccf9128f0145f2c1f1fe2990a4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 69e722c7447f052d7f4f48d7342f35000d20a722ab4f34fa4fd745e2d647998b
MD5 0db5c2838a6bf398d25a72a67fee45d8
SHA1 8351e59f79b433c04f31581a11f0cdac2772e95f
SHA512 0f04b069817678d8dfeda0b5497d4f0742599f411519f9cebbf2d2514a8ede5e2c2209c006d0bafa92d5d92c4fffb7dd252de68694e46cccfb387bf2177519b5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup4e2RUxJOeCpFXWx3Q/Q:A9iIxuERzA83h09RZxY2v9Q3Q/Q
MD5 SHA1 SHA512 SSDEEP

Submit Download