hxxps://usa[.]tx[.]ms/ZUJPEuOTa7G6L

Analysis

max time kernel
241s
max time network
269s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
25/07/2024, 20:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://usa.tx.ms/ZUJPEuOTa7G6L
Sample240725-y4bbfasdnm

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3628	msedge.exe
3628	msedge.exe
3104	msedge.exe
3104	msedge.exe
392	identity_helper.exe
392	identity_helper.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe
3104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3104 wrote to memory of 4668	3104	msedge.exe	84
PID 3104 wrote to memory of 4668	3104	msedge.exe	84
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3948	3104	msedge.exe	85
PID 3104 wrote to memory of 3628	3104	msedge.exe	86
PID 3104 wrote to memory of 3628	3104	msedge.exe	86
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87
PID 3104 wrote to memory of 3964	3104	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://usa.tx.ms/ZUJPEuOTa7G6L
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0cca46f8,0x7ffc0cca4708,0x7ffc0cca4718
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4616 /prefetch:8
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,15919088912488046919,9062818128540967907,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 d03f773db9ae5f367e603f22bd95080b90f472b61bbd9605bf24a492fe015030
MD5 cc0f7d31664b59d6ae34be6adb946e07
SHA1 809940009e7ec93d74bfbb0b114c17c54ea4ec9e
SHA512 ad5fb65f593e075c94b7b6b24dfb244d4fe24a7e122423fd7563aa60a65c15d127252073d01c2cfa0085382318c501258c2d1d7fda98d6d03bf20437a954299a
MD5 SHA1 SHA512

Submit Download

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 328B
SHA256 699903dfe32ce500e9ddd457b0b98b2eb13677c442506ed612e41101541024d6
MD5 7ece177ea2a1ca315e7434cc8608f96b
SHA1 353e3dc12bb755a5122dd4d16cb5c88bc5c5e51a
SHA512 af3904ba1b09fddd8a43296c3610b1ec4aab97a43a41282678ebf1f52798fe8b709a20cf5833376a0149efcd130d976a571bb3feb807567237e739053ed3e857
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1
MD5 c00b0d6e0f836dfa596c6df9d3b2f8f2
SHA1 69ad27d9b4502630728f98917f67307e9dd12a30
SHA512 0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
MD5 54f1b76300ce15e44e5cc1a3947f5ca9
SHA1 c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
SHA512 ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 288B
SHA256 a7167ce604fc2f10242eb134922a500a2f0ad80adbc4bd71ce851b76cc9ff4e7
MD5 1e0aa65d227b60b8ab9842f496ba89ef
SHA1 8434272a76898de52329dd2b4503db0de7b0d627
SHA512 adf07c02e5de6f3079d287fb6754ca5c19bc90440eb2d03c5aaf595ae197a9077d174409de4ba2556ae628dfe728037ebc25de01b9be414bce2429b2b089aa22
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 5e3de63c24f97e00f4f68162b8a0afdf1ec82b3681327008a14d9ff163f6c6ce
MD5 6ecd6175455d2369ee88db2a765d9021
SHA1 a26a42132ec8bd63d191f3cb0b7dcdd179a3b3b9
SHA512 a0819a69ebca5727a6b68b674b8653a085f30900825997fc589d90ada92af1d0bf5a4fbdd60443435ff36701ed5517adfb8023c6a8341fbd574f930aae39bb22
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a7e6f7887d7e63eb14b179f185686afa21d65d0e000a3c07bbb69cb46d22f24e
MD5 63e8dc896a7a740928d432435ed1847c
SHA1 658c2c0e8460c4fbe7cd219ce972ccf9a00d5f43
SHA512 e68522171861b27ca24c68406d77df798c0b3cfa6f580dae709358b70d41b0ef2bd1a9c215db08224fde2476ea6caa32b1a3188bc8452ca74c4df19837ebe16f
SSDEEP 96:nVkOt1REUwpvWMoiVmdeH7cF9lJDUWQyV+VDCziEwb:nVkajEUGWMXgLlJDro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a1cb18374d1efffe1b23d98e40c6c77a6ddbd4c9d6ab46c56b901bde9439183b
MD5 617097c6c7d3701a6132476fc75f3689
SHA1 362b875869240cdb4adef020e399177877822e6f
SHA512 dba68954c3bd4f2ec4fe138b4c997ba1211770ef7605ce3c57c51666be5f1ac3bfca5263c8197831880ff919e46ad0c2808c10fe5b8cad49f5c7bc936d7f3158
SSDEEP 96:nVkdt1REUwpvWMoiJ9R5mdeRZuX1j7cnF9lJDUWQyV+VD7AiEwb:nVkbjEUGWMDhuXhgLlJDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 781465963b371442d10df77765ac10fdc7197df74e3239735e251b5b2dc7c7b4
MD5 837f182e4128451bc3c470f1504fc992
SHA1 2339b3ed0b94ec9bb2c83356f9118aae88267636
SHA512 f7de897b055ecbcfc6bdacfe05040fbf73d227b564f7e79db3bf1ab5fb7228deed62148f0b8bdfab4344f30f6604e8edaaff62c0f9670f53d8ed4c99ca416d66
SSDEEP 96:nVkdt1REUwpvWMoiJ9R5mdeRZuX1j7cnF9lJDUWQyV+VD7AiEwb:nVkb/EUGWMDhuXhgLlJDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 0a6a11a9f200322d3f5a3057487b47da164703876d44d02c03fcb1a48d0dbcdc
MD5 c8250c144add2adf956c58e019590539
SHA1 285d6a5152de8f753600a381a7a5e63cf2485aa3
SHA512 78aeee9c7641349bfa5d8aba0a6e886fd2202f51447048898979703a5bdae207d17f1fd6fd2cf3eada1503474296391859a0453c8e39ba6b69c2618685d4bbf9
SSDEEP 192:nVkoPqvCipv8t/EUGWMDhuXtcsrqgRjlJDVg:nV3SCac/EBWzjNjlJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 733162bd1b0e9180f7b3e9a7410edae31535c01e13dd9b3ce9419edbdfdc5474
MD5 a3c48b814de58f29e17b9c1df4699f48
SHA1 54c4a7a5b965dcaf710c466ae26c173136d6f4e2
SHA512 4c25377ea29c1b9d5fd41fcfeaf2085c1cde3ed2d3e3c051cd2ffc4826d13c21762c98132c7291bf0cb85e4580b870732b2bfc3d791fa86c90d32e455ec35d3b
SSDEEP 192:nVkoPqvCipC7R8B/EUGWMDhuXtcsrqgRjlJDVg:nV3SCxU/EBWzjNjlJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 b7e2b5cc1e04b09f90ca55aaf428dabcf85941b7c4d3b4b35eafefe06ce5a0a6
MD5 677d4e34c1607240fe6b55a60de1ff5e
SHA1 d78972248192002d4858ebd4d5f0ad85e15f844d
SHA512 b45621739260a1cc59b0e62ed22f47d625fb27840868f30da8bfa5d956443befb46bc404e5e26d18a0ae347dba7b312278faa06ceb9b5599f471476328442226
SSDEEP 192:nVkoPqvCipC7R8G/EUGWMDhuXtcsrqgRjlJDVg:nV3SCxf/EBWzjNjlJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 640942905c4e9d91302e00038e157cc8a796f5b3966882aa54578f36e002d5ff
MD5 b94b65da5e4d7818988424b8bd346080
SHA1 caa3ebccd5467891cf0fe72de0183eecf021affd
SHA512 8dd5f3472b3b85a47b1f9372ec218bc16a72227aca088320fa75bfd16e4eb5bfd034397c6dd8960f6878e44b1ec23c47b6f125a99d05ac8c7c77c52719f00b56
SSDEEP 192:nVkMPqvCipC7R8B/EUGWMDhuXbsylqgXlJDVg:nVVSCxU/EBWz19lJa
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 4e87e100ba2ed9134ae458d84a7f728f696ba697fd1a9828c3280a2c5833039f
MD5 492045bf692259a90f073cdfa4251a82
SHA1 1ef41c70162b8e1313f158eb931228ce48c5cd3f
SHA512 9c11b18fe69f5464e4e799fd4342811255a787b60401226354ef309675239dbeb1e9923d38ef851793bd004b27b2e8ed883e26ab34627772f99159fe093270ff
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 bca85425ec66701bf9888bb2d9140f240acd1130de3ad60b3536c352e8188969
MD5 a57ae7522ade9d618484ad89157c79c8
SHA1 acf246f4e23c858ec983f2afd8a191be719ab017
SHA512 8e065708dc3876daec259099d398acd6235d4410f61178d961eb28314709b83160447a0f473b5473e9f722d4ff54048dd6d0fe6880feb696a83dbf3bb8927d25
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57fda9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57fda9.TMP
Size 534B
SHA256 b482d9454d596c170bb439ee2e7e04c5d58e54c333253ae7765e0ced655b5613
MD5 9e6363efd9619c87f044290d5d2e8ae9
SHA1 68f7450b5aed1588323719584209dcba783df820
SHA512 e68bee7332d110afad0ccce49a232719ae846739375ddec9e88cd6dda69817031930f6784592a64bfb2c6a148cd2d6b26a449d456af7cc71a66531268e3b52a1
MD5 SHA1 SHA512

Submit Download

a8d22720-683d-4d1c-a25e-52e4d41e8c75.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a8d22720-683d-4d1c-a25e-52e4d41e8c75.tmp
Size 1KB
SHA256 c5f9f309acf8195ddafdefbaa6feec400c4aa101759434ec842816d20c3f63ac
MD5 c4dfcd1bcb1ea38425ace2b502634a5d
SHA1 db2f3b72856185b4ca8ab9392278a0328e779922
SHA512 6a32dda872526eb443fa6637a184129282ca8abbd16b704ccbc0fb2e6b23f5bba5f7c54dca9134aa8d6e016c3cbc2e0cce4fea85e6af4174fb0aefed17a7602c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 690c2aebc1143adc254e8fb941c7f557deccece0654599d514a9d324dcbdafbd
MD5 ffff678071ad61df0516b716b1b06d02
SHA1 c6a4fb6bcfbe2ef3bca8572d71441c9b7ea77059
SHA512 297e484439aa2f491e107f794f238cbf1045a2bb069dd7c3b9022851e494a21290d692945b9e41bc18b3de3a0d1b90bc64d6f40909b20a430b6b578c97e616d0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXiBe2RU6dF+eCpFXWx3FBc:A9iIxuERzA83h09RZxYSVX+9Q3FBc
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download