hxxp://google[.]com

Analysis

max time kernel
242s
max time network
244s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/08/2024, 04:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample240805-e9tv7a1crb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2952	msedge.exe
2952	msedge.exe
4440	msedge.exe
4440	msedge.exe
5020	identity_helper.exe
5020	identity_helper.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe
1272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	4008	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	4008	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe
4440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 4212	4440	msedge.exe	83
PID 4440 wrote to memory of 4212	4440	msedge.exe	83
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 3092	4440	msedge.exe	84
PID 4440 wrote to memory of 2952	4440	msedge.exe	85
PID 4440 wrote to memory of 2952	4440	msedge.exe	85
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86
PID 4440 wrote to memory of 2784	4440	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdd39046f8,0x7ffdd3904708,0x7ffdd3904718
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5396 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,4395679060628641235,16492448426628247938,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4b4 0x2e4
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4008

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

1b46f7ae-f2cc-40d6-b7ec-43c731ad6f28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b46f7ae-f2cc-40d6-b7ec-43c731ad6f28.tmp
Size 3KB
SHA256 7c0f01cc739bb44927c6cfb5882aa99b279a644ec582a0f78ff00427279248fa
MD5 c591befe0af2f832f83985f7a2d90724
SHA1 3d8bb49dcff685576e4dfe6b84d72b83f234998c
SHA512 7174a4f94dabeeba5a584b8b36ec359e06c6425bf2eccaadf840fc752dffe6cf3320270bfddccc3ef12bb0dc1eb537080fc730297261c29a71180f123b4f6038
MD5 SHA1 SHA512

Submit Download

f_000003

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 27KB
SHA256 10714240fab1bf95a09c0a6461bd3621783b763b6847bfa8255622d7d13a4fd8
MD5 6da5998f8e90d28378c84a2f8b1acf9c
SHA1 1eb55404a9d4089239d61f07b64d83d16d578bca
SHA512 8a96b06b85ef59794870598ce40cd67fd1d608ddb08ea71fbe47e499dc449461ba0a0125188f16efe33a4e22cb8fac403685ab18748a119379aaaf2327976310
SSDEEP 384:iE9X15KQwwDRSTn+JOkMRYbXsOYHDS7nQCC1YVaNIJ/RipRq6q33wqrTOaouWuaw:pw0RST+3JrpYIQCCzNIpRiqVGvvxdLe
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000005

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005
Size 65KB
SHA256 cf8aff471e9ed017445eabacbc82addaf821f2e3b6a3a73e155b78368e66fb11
MD5 afa81ebaba0dc5e9aaab3cd9c1cfb887
SHA1 0ebab42f78f37a2fca42a171419c1953c0f2497d
SHA512 7708a94b465bc4c17aaa7b61845b0c738106c8060f6632e07c068b1ec374f5e373cba007eb4eefb6e324267cc76b37f47ca6f5ee2db712f32008343b6249bd4b
SSDEEP 1536:tXxAquzoPSq6ZVq1sQkQMEznLwaH54HCJcWVZ4oVOURDLSUSHp:tXxFuMKVVq1uzyLwaZMCdUopRhSHp
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000006

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006
Size 80KB
SHA256 90ea4b07f2bfe425d5868f33f2904c0a48eea7d54587a472f4d669e2955e077c
MD5 5736c702c1a757fa520ccde3ef511025
SHA1 0150d82de9da40a5bd3c6fb3fc1945fb4b425a19
SHA512 ece14651d41df40b24be258ff9428e6ba641e4d555f122a47c4758b09bddc724346029224fc233845efba6921e998a6638e0af10f274ac5a241022c3c0eb1982
SSDEEP 1536:CsSLJ2jDo2WOpScyQu6gaqTGZuJqUl4GA2rwxRXoMu7VUMeHw1PQA1:Y2PhWwSbZsqTtddGxRXYVUlQB
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000007

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007
Size 99KB
SHA256 d6fae7362b0ac2c40ebd93870b9d93a98c65d4f2e7ac283d5b7f1e4a511a820f
MD5 a4734d8d03cbe156b0ee79fb66fcea62
SHA1 7318af5386938ba9f1a2f185244914d2dc6cd920
SHA512 b3a50d51546889ad4c1de4bf6251f96f0764a27d7609fb8a35a01f01f2dcac5ac0761b630ec43b50add4f16cd847841213ad4a484367904f2970a5a2c2186c32
SSDEEP 1536:lmxT/czE7uZvhNvEm+PjGGDwLvjdKy/3Yf3DwTMPhVlARD7J10zryJWXQb3P9:OUzE7Svh9ijQbJL3y3DwTUjA7J140f9
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001c
Size 16KB
SHA256 6e9be773031b3234fb9c2d6cf3d9740db1208f4351beca325ec34f76fd38f356
MD5 48c80c7c28b5b00a8b4ff94a22b72fe3
SHA1 d57303c2ad2fd5cedc5cb20f264a6965a7819cee
SHA512 c7381e462c72900fdbb82b5c365080efa009287273eb5109ef25c8d0a5df33dd07664fd1aed6eb0d132fa6a3cb6a3ff6b784bffeeca9a2313b1e6eb6e32ab658
SSDEEP 192:/u+H3An7ybVSpBjen6K1GegJjgF+TDg91wTr1PH3kV/LQB3OJIuq/Y4RBF4B3ve:/vAvUxEtkmZZY4RBF4hve
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00001d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001d
Size 29KB
SHA256 4b0beec41cb9785652a4a3172a4badbdaa200b5e0b17a7bcc81af25afd9b2432
MD5 f85e85276ba5f87111add53684ec3fcb
SHA1 ecaf9aa3c5dd50eca0b83f1fb9effad801336441
SHA512 1915a2d4218ee2dbb73c490b1acac722a35f7864b7d488a791c96a16889cd86eee965174b59498295b3491a9783facce5660d719133e9c5fb3b96df47dde7a53
SSDEEP 768:oAQsDyy4sdW7Bpud9WAiJXevVFyD0516r99ZIiFoF:Yxf7BmWAuXefyg516+Sq
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039
Size 16KB
SHA256 201ff0cba3dda97312a40f4c175129cc078beb4a51bf56684713f93cea14485a
MD5 6c0949d2cafb4b0136e62e83f69aab34
SHA1 e15091c89e7c0e364993d8da0db159f5c143830f
SHA512 2d47fdcc9c091b1de9b040d51b4eb0e9ee01b904eafae3d6f284cbe437b955a5a69e5f1705d02efff2ed77c29e876a8a25115bbef26a12fedc3e64a20083ecbd
SSDEEP 384:/0wwRD7ZRjG2r8OeFAltudTJnTLf+HAE6/54QCozyZrVhAEr8ECKgP9ssBUK3Ds:/GRD73G2IOeFAlsdT1f+l6/7CWyZrVht
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 888B
SHA256 b05b11476b5573365994553eafdde67cd891fd18783612a39bcf136ce96ca153
MD5 181c09b7a87770e83cb7cb4a627bead7
SHA1 d469977ca9de60cd56c7ff39891b077b99e8e9d7
SHA512 3238e81690ee7ee8aaf29c54f885c7d4fafcc24af4da020f6190aed09e11ee7cda1d86f18ea9d6b1b4fcd4d093a3a1039a6e3243847e23dc3b8eae0f485e702c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 33e9f03152b08c864c99338c666f584b2e7a6fe299a8f63fb46088cbc675b3ad
MD5 619b413bfbaf89db97590645e21c5ee6
SHA1 529abc1ca5adda5b38a8092ded6641c1d8097e41
SHA512 fc75d7ef85314a6ea1abcb50248c492fc7a5daf462352bf861acbe417a31fe24a762869e19cd2c3330ee00393314262752cd02b0b2cb06b7406f0afd72007524
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 26b1ed2545282c2462f25c3e897bcac6bb4e97bb0af4de406caf66e84b0583e3
MD5 c4fa88ce14d0edb102d947c91e060927
SHA1 df2a8b9f8bbd972977e016d1be217ea910bc6590
SHA512 7381c88924d78abfffc081a7b3c41fafad675101478f50944b4d24b6f535cbefc6958a4a67b57ec7a100d35ba789642bafb8ab6912329ea9bfb1b898393c6509
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ae2cce1ac5e13e0246f6b4031e316af8deafc60189527963c5ff44bc4c8ee822
MD5 7df5fab82a10ebd9e4c1597d83232125
SHA1 949200f0fc01b0e0864e48617c57adb0948c51aa
SHA512 a45126a0bd2b3e47bc7dbc14921ae65a9c9bf426d17a55bd3122f7cecf6325822dd3630cbadc79a15d4f8c3479ffb5dd004077bf30d24a834df95003b28c6f70
SSDEEP 96:nOAk/UwI1x8LSFhPwpvWMoiVmdeH/bt+UWQyV+VDCziEwb:nOAk/CvVFhPGWMX5+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 758a60376963d102595dee58a75692a36485b6b4c8215f8284bc572c73786afb
MD5 854ce084c5e3bbd2c3fa19eb2581841f
SHA1 7b84da8fa6da3a76e8f186a0c09095e0d19ef794
SHA512 c8adf340b9b32c64f6dc0e2d5e0decee5f301705ffc376512cb3db3fd43e29dfbbcff50c3dc03bdd37b96fa47bf77b7147cf30a630e7f933ada3baab44bb2e8c
SSDEEP 192:nOAk/1DfFhyLTWMmAuPJaiixcR4u+VafVq7+Vg:nOAQDdhwWv1q1VfZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 02d8da267106272a6d49a81b172961c29567562025d70435fbafd1d32d677287
MD5 4898748b912fe4603d4ab198cf9d120d
SHA1 89d4b8400e75c3527c0a4c74a452188b362c4c66
SHA512 8d32d2088b19886a229259a29977d98a31f036cd51c248adb7be779c09d9b6d19b597bc972e9836b4480b3d4e24140e21c189de2cc0eb01c9a584d1674e8686b
SSDEEP 192:nOAk/1D+FhyOpWMmAuPtu5WQ4c4ZEVafVq7+rg:nOAQDKhJWvGKaVvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b479ef786f2fcbacf20c1c5bceccc3dd34a6261dd523ca9d7a4defbb9f8550ac
MD5 8ee7b29f76f19b2bb92fa440c293fff8
SHA1 90bb24466ea636b4ea891fa1983bee7a149b72e0
SHA512 d8d6538ce5fe8dbd9ccf16d9a9fe377bddb3edb5e38fbe1d69db1995146357636c194d5eba7ad904ba6992073782a5f3abc1e907b0c79be6d90b5507d3a56cc5
SSDEEP 96:nOAk/PwI1xELSFhPwpzpWMoimR5mdeWuP1/u51FgG+4ZVq/Nt+UWQyV+VD7AiEwb:nOAk/TD9FhPOpWMmAuPtu5jc4ZVq7+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 a64869b6ac12543dab63f5e5054ec05f2a0e03579b6b075bebd7505306edf539
MD5 69746d474c49a0290a24a31315fdba1e
SHA1 bcc5bbd15c9137935dd6dc018586c346339873eb
SHA512 246e9f89a48f2486c0c7bb730aa2cc592bcf51e498f2b35072ace494f42d2b60dd5baac2065df64a0769fc05d8ba04034132e4d4ccac9bfb8251fac8fd87d3fe
SSDEEP 192:nOAk+qkD5FhyLTWMmXAuPJaivRakx/u+Vaf+897+Vg:nOA3DvhwW7191VoZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 96B
SHA256 bf29846fda962499498f9f908940e45e9fd32c0da04a58225714e45a61a106c6
MD5 2f724b2b892e09184a9789d6bd59ac16
SHA1 07122540dedb4bfa79310961e436712b090be2e4
SHA512 8dcd0fa1da2e2161eca318f6a8176147c97e1c1917f9f0ccb6614d566283318d8403256f1cf8534724e3856892f2cbfd2b232c3d0245583182cc7d3b9e981b3d
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe5815d5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe5815d5.TMP
Size 48B
SHA256 219abc2a342933b4279fb63a66a7154ea5574c8987a2146dddde1992535e46ac
MD5 3eba6ace56077c24e744df4406b14f6e
SHA1 1fa86f8cb743fe14c0efe81733e0c51759160f75
SHA512 7e480f38d70d74422bfbccacf13d5296181ca328c1d91ccbc76990bddf49ccf0b433411ae85e07f8ede521e0a9d6e83b5a633490397c9bba63fb65a0ec525f7b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 537B
SHA256 953faa590b5a570c3d6cbab9a545d4f6557b48e881e41ad290d86ea813fe4a45
MD5 7037a869811d50d63f5f75c5fb479a43
SHA1 ef5e7285644eecfa26789babc49045bdcbaf152a
SHA512 f0295b0dca9a3585edd71ab5cf234e3a30e56985da013d117cad987fbcf19876da1fbbe1ca178891f2aa904d94514b53c331a7ba3eefc029b780f21c3999b04d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 e5746f4f804032ce5d1e3bfc2d662c99c0a84445ac40b77e9ec05857c6834f76
MD5 40697ae30e089b29e496c9f8a94d9b73
SHA1 d5dafe7393c0bf8335a84a3f40edc7836bb276f4
SHA512 5f3ca8e2ace133e33940e3f86d7fe845e4753f4b046494172a5716eb422e2c1dc0f6b2e78a42355ac977de7bead7b1647079fbbddf62d97748d6428735464eec
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 2cd2259823053a581117c01f61d0a6e39c0fd3df58d20c3fdb76399d30f7532e
MD5 4743e209be7fed80fcb53d881e98c175
SHA1 61542537576b4ed97094e21cf601110058838ecb
SHA512 1738dfa84ac6b651cd965fe97c3bc01c1110053fb57ad9a2c3e83749d2b03acf8e9530f51d65a1aab25981287b505c63c72129bce14976f4e0d9e7030e60d4e5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 691a66e9c35db3661193ed5fdc9a44f4a746e056854de4f86a3c703857dd5c44
MD5 9b79e67a5cf69e7c5a56eb834e0415df
SHA1 4bea549cee3e59a3b0b556954f868ea1172c2aec
SHA512 9f561c045716e8f4365e00517abd1cd536ffe3e15e1cf5433de03132a60a790b8b059c38b0558f0519563504e7690347c8296c5d01e5cd7eda1df1a7011ae37d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58502e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58502e.TMP
Size 537B
SHA256 e9f46d23ae1fb6cf1b52ce17d104b699c407501599693c5ef0d780b907c847e6
MD5 0ebe55f1e54a2a21ac6f054d98aeb0cb
SHA1 5714ea6b762826c72947da7d61d4d02ae12930de
SHA512 6491fc8357689bfe414e8e490f2e3f0fc4570a9ccf3425fd327062cb80d4e0df7a1ba27c0b194bc335e2a56b0c30caa8ab0c6cf3f6bdfcaedb4ee1c1e49b1dec
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c719c0c751c32ff2066ca25af33656c3fa0a698522f8c5175f5a5d58cc6a704f
MD5 a90743028e83303f75364934ef64561d
SHA1 1de401be8ca8a4112cbc271eed420fe37598deba
SHA512 4e797c99f235224f04f991a2150bc421c41ada0236114f81e0f4bf8e79a0293c80c621eeba3701dc81d90dd4078fa7147d4f1ace04084ce94eb4cd9e4ae55925
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupare2RUYxNrs0KVhY3IKW:A9iIxuERzA83h09RZxYa71DKo3IKW
MD5 SHA1 SHA512 SSDEEP

Submit Download

default.exc

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.exc
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download