7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add

Analysis

max time kernel
143s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
27/07/2024, 01:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe
Size 39.2MB
Sample240727-bdvwtswfml
SHA256 7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add
MD5 7d0697549405fa4a37663fd1a5fa27b1
SHA1 baa4e2cedb670b5cd0d4997365634681296750fa
SHA512 a5c089b6407690f1308c5a1a4efee7c0ae53d27f95eb5ced3fdfa7d796b63396520dbd5b5f8d15fdfb81ab20d25106df3d6ff8ee1c4830a281c63a8cc239e47e
SSDEEP 786432:tYl6iTfRwFOU8ofAl2jpyJk5cDxvVIyaPZ+:If2V89l2YJYcD1E+
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4672	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 579196.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
4672	msedge.exe
4672	msedge.exe
1040	identity_helper.exe
1040	identity_helper.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe
5400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 4672	912	7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe	91
PID 912 wrote to memory of 4672	912	7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe	91
PID 4672 wrote to memory of 1636	4672	msedge.exe	92
PID 4672 wrote to memory of 1636	4672	msedge.exe	92
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2880	4672	msedge.exe	94
PID 4672 wrote to memory of 2868	4672	msedge.exe	95
PID 4672 wrote to memory of 2868	4672	msedge.exe	95
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96
PID 4672 wrote to memory of 700	4672	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe
"C:\Users\Admin\AppData\Local\Temp\7c8f55b195031e52864fead3fb095105b4e8b43eb74ca5f01247ebcde3947add.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - System Time Discovery
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8aea246f8,0x7ff8aea24708,0x7ff8aea24718
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
    3⤵
    PID:3552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=4984 /prefetch:8
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3872 /prefetch:1
    3⤵
    PID:3048
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5560 /prefetch:8
    3⤵
    PID:4976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
    3⤵
    PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
    3⤵
    PID:4888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
    3⤵
    PID:5228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
    3⤵
    PID:5236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2310382660008104936,1888853518743391230,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1372

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 578481cd359c669455e24983b13723c25584f58925b47283cb580019ef3142b1
MD5 c00b0d6e0f836dfa596c6df9d3b2f8f2
SHA1 69ad27d9b4502630728f98917f67307e9dd12a30
SHA512 0e098ab5f5772fec17880e228a0dccbbaa06dc1af14e0fd827f361599c61899fe07d612a7f7b049ff6661d27fdc495566dd20fc28ceed022b87c212bf00be5da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 43dec5d87b7ee892a3d99cb61f772ba403882ac0772423f36034e84244c1ca24
MD5 54f1b76300ce15e44e5cc1a3947f5ca9
SHA1 c978bfaa6ec6dae05464c6426eaa6cb3c3e2f3b7
SHA512 ac26e5676c675be329eb62b5d5a36a0e6014ab8a6366684b0fc2a59ae5f061f596f462b82eb4e9f135d2235a0cbd4af96680d234eecc873a8397fd81507d277a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 b088181cd47c0e374db458838b89c479d844e127bd541baf69d7b8f5551144ab
MD5 95d2b756ab3d5431fa0f35858a2abcb1
SHA1 1df02d285fb1be97a6ca90496cf9a2087411fd0a
SHA512 1b004b1d6ba20c841c038e53330048bf64f26baa814b483c614eaef4d4ee01c9be351759ceda0f1da58c0fa256d2dd3c4714ea782de50c846e4a9a738937a936
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1002B
SHA256 49c188dee26873180d501f98e93a1ca8153225c8e006b93d019709cffb8817ca
MD5 c8fe5dc3edbb8ff8243c36c490cf4899
SHA1 7aa7c864a6c171f6e9d072b1346486d86182ed78
SHA512 f08b91c2ddf4ed5d230aca6e57c0cd0f821bdf0384bbfe3ba6eadce74eb65fb44da94c8cff55c645222d721715bcb04365d73807493eb9558f87de8b36c4e7ea
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 db7599499ce3f07a7895a0b0848d9e600db7464d42be2bf8825e56ec878be960
MD5 33d860dcae7c41f012cde8332b43f026
SHA1 d3ad71d66cd259f8acb7a5d129683632377162fe
SHA512 9991977679a4e4b66e6aace9ff66cfcf246b21fcd517cf20530d9fb15ffb41644ea36d0a5e7a03eacb77f61b886b84b76977c665270b4b44b903b1de4c51fa31
SSDEEP 96:nRkk/1RcUwpvWMoiVmdeH7cFZHP+UWQyV+VDCziEwb:nRkazcUGWMXgbv+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 93939658b80166d3b589bc11dc820cf83a9ba924da7548c9ab669799b03f7332
MD5 b0aa3bd1d1353bd5bbe3c1200f6b3f0c
SHA1 3b2dc4e0c43bde1b7bb63256bf07fc00f0ba8589
SHA512 025c3fc26b94205d542c964b0381e0455347591ef32821e2fc231ca2a90450baa8914018c739d4bc0efe7d46aa2940c83d62f97e2ef1e4b0181973140f61339e
SSDEEP 96:nRk8sQM/1RcUwpvWMoiVmdez9uJ1j7c6ZHP+UWQyV+VD7AiEwb:nRkHzcUGWMxuJhgav+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 d2801d0ca33726cd05ec45a83907cb7f031ef00d1906e3138ea47bca7d3337a3
MD5 d55ca148245175dc257f714ec1ed8ba0
SHA1 c0269b467a0460b43f368f6e654bfa32879c460c
SHA512 95c5b5b5d1188c61c2806657570fb6f5c3b53d6065321228d6379ce8e334eb9b7cb1be656cc1c2822ae74dfda587ed588fe7eff62e0fca8f3c0b2216647e99b0
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 707B
SHA256 954274317d7076e0e101de7b81fbe4970c83be1aab6bf8d995642a3dbc9ed069
MD5 7d1da86df3ef2e7fdbd57a8e5acd9592
SHA1 089a4a4a1534124a6378d30b9d143db0ee93befd
SHA512 ca47231462a03e72532d87e6163226e938710db2c6c6c489a688fed8eb23317dc58de188e139a9975405bf6522ed4b9cc6f86a8574d13c7b3c6a1e951a6a7f70
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58b84f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58b84f.TMP
Size 539B
SHA256 646cbfa9eda07686b36db805dff6b6ede52c2d3e5800dbf7712c8b28c2ec094a
MD5 b8232f453868af81273cffbbd80a9a21
SHA1 a3f895d5965cef8f5bfa853c370e3904102c71bb
SHA512 506377d1f8532cc5776a14bd3ba0adec111654b1f919bc703c165ce519cec289f2413a89893888ea1ca76f5d21c15fcd3634845f2cca6885720311b0eaf97660
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 a8fc76b23d43c11272a24118a211cf41f644dbc124fd4955b8670d88fab69e81
MD5 8184a118d427347e8fc0c5b9468d7a9a
SHA1 c3d8bbdab3cb7014dea2de3083596d30862c890c
SHA512 5a60191d7649b28f1ec9ef71d73e4d58fcf868033c7d09e553f5ea162a927f839005acb54ea43427a87dae9a8a8f158c86e6988cbd161270702298f3ff0e2e28
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupviEe2RUQdF7CpFXWx3Crf:A9iIxuERzA83h09RZxYqqlCQ3Crf
MD5 SHA1 SHA512 SSDEEP

Submit Download