c48c1c7e35401ca14d5b89ead49163739e7ed3bd1dd368b2255738a2f985a14c

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c48c1c7e35401ca14d5b89ead49163739e7ed3bd1dd368b2255738a2f985a14c.html
Size 288KB
Sample240821-psy4pasbmp
SHA256 c48c1c7e35401ca14d5b89ead49163739e7ed3bd1dd368b2255738a2f985a14c
MD5 b34307d87eed1985e63699cc5feb40bb
SHA1 45298f013d1f0230dbddc78b221a7f8a7fc17286
SHA512 2771140c629bc4c958cb11eaa97c06223a74dff27f09c548d58d39975b5784e5615007cb65d1fa9430ef7498aa984c03e23d20d612ff3dcc8638ad69eabc62df
SSDEEP 3072:IZcF8znJ2yQY8/g8SrytgSWm302HlDNFK+Hz2gr1Z/NO4C7m3ytgjq7TdEd8CfWJ:wnBQY8/g8SkytAq7TdEizkCt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1804	msedge.exe
1804	msedge.exe
3808	msedge.exe
3808	msedge.exe
3288	identity_helper.exe
3288	identity_helper.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe
4124	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe
3808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3808 wrote to memory of 1792	3808	msedge.exe	84
PID 3808 wrote to memory of 1792	3808	msedge.exe	84
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 4816	3808	msedge.exe	85
PID 3808 wrote to memory of 1804	3808	msedge.exe	86
PID 3808 wrote to memory of 1804	3808	msedge.exe	86
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87
PID 3808 wrote to memory of 444	3808	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c48c1c7e35401ca14d5b89ead49163739e7ed3bd1dd368b2255738a2f985a14c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbb6b846f8,0x7ffbb6b84708,0x7ffbb6b84718
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,445351107246717088,3949209873287879010,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4768 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 21KB
SHA256 4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0
MD5 c3a1bf5fbff5530f55ad9f9fa464f25c
SHA1 449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa
SHA512 75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54
SSDEEP 384:uZIPLgiXhd+U+WPd0gxWaBRCtabXFtSNnHEURIwQD+BUJpQNozdbXB:uZIPLgin+bGigxWyE6DIHEnySJrz9R
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000016

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000016
Size 135KB
SHA256 bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4
MD5 cb98a2420cd89f7b7b25807f75543061
SHA1 b9bc2a7430debbe52bce03aa3c7916bedfd12e44
SHA512 49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e
SSDEEP 3072:v09yvZVdMDYywVB1DKD5q3OYHiB6wd77sX7GUhwUEV:c9y2kywx8sCBu2/
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e28ac00cebac4fea54214a93dbf32d112f49801395eb4007ac508a3eebb017aa
MD5 1122e257f35fb8541421c4f8456e1c74
SHA1 9ee638d72243d2f5ee3856059ead97b3d1c59a13
SHA512 db9a14445b111a38c638e91fa36600feb065929ef18ea55a67f0d75e8f169257a6d201ea2a376c5ab750fe27eea964520bd71690bc0b57b39c8a54f4809ceaee
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 e1f7abb34fa0e27e94d6612e32bb708df667b5980526d02950e80c9fa4cc34cc
MD5 73c80d0bde1d6222aae538d500688584
SHA1 301784a854fdd40d149c2b491af7d42341e595d2
SHA512 a956d374c18e515ad097d1f55f916f9a8356aed4f12154e0d6e31c14d00297ae571a47929708efe09bbcccf66facda764a39b4af0a7f9aacae3478f407e9e513
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 6b8beb7d90367e15257a12b3395458b4eeeb30a13f56bcf046c5358d8dbd2b7a
MD5 6f783be5f9800455e9e8dc97af13a882
SHA1 d5e774efaec73dc6dd8abd6de74d5045d261d8f7
SHA512 ad6c223c4c3820e3bdf038622c404063b2f797592fc0c18ed120f6f4deaeb74ae8bda91823132c1845dedcceaaaf0c2d47889996c5c85d25241606387938f661
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 480e3bc3dad3d08c02e356e1450e038282fdcea4b400e8066f97e0287fb21ff6
MD5 e0b80b4678b47e02d0483485a4f66ff9
SHA1 04e6dad46ee0d5a57c2e169be663a2a15f75bee8
SHA512 e1709aca9ba90dad1219605a7c209203ebccdd6620698b412bcdf156b44ff96c3051b07c6a282d3ae47c569b62200914b87fdc3fe1f3472fb669929497bec82a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 bd92b28225655e66952206db51eebd5dccdf0edd9ffee00e50f198924eb450a7
MD5 a82e2906847508ca1845d330756cbf5c
SHA1 fbaf3fc4fbcd912e08407a2796d2ad3bf5ea978b
SHA512 2f2431f4e649957597f78e53df906fd3f5f6e5aa58233164595c470d719854c89dd879ea4669cd7dcc8b0a55fd831d7766bc01b8303a83194c59af829fd5ead8
SSDEEP 96:nq7kzo601iURwpvWMoiVmdeHm9nwHUWQyV+VDCziEwb:nq7kzZ0ZRGWMXYwHro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7865288669051b0ff7b3f56211585152d5cbd967c9537413427ead78e3f7a4cc
MD5 194aa2f3f85d4d9fc46414ce21dfbe40
SHA1 61fecbaeff85a83492027dc618d851c7bd8523fe
SHA512 d714954a22a82be9ed061f5790ec3becffdc037915225f51b9ab933f2c48dff84fb94d869eb574c6183d00bfc8d73011b2a32321ad524ec7988f2eca05620f25
SSDEEP 192:nq7kzL0ZjGWMkuwhwSvZGSFSXY4P20wHrV:nq7k0ZSWtViSMw6p7wp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 2952cbb44c4d6a3c27225c9e65e82c3a96718c5e1b0a727cf77fe65cdc2b20d2
MD5 591b074070068f653b6b4a244151d1ef
SHA1 7828ca0c03fd3dad14286f65761be1d47c177bd7
SHA512 474a7a0a8c4129963dbaecaacdf232ca9a8074118076d2a572e511db248dd6b6fdaeb33dfeb4a42669cd429d63600ba866080a59742f5b5dab1e1196bd55be95
SSDEEP 192:nq7kzL0ZRGWMkuwhwSvZGSFSXY4P2YwHrV:nq7k0Z0WtViSMw6pjwp
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9621ef6af416f7d559b7d4607c2c0949c478fa533736b57b3629f6a5423ebe48
MD5 0c3219d6e832f2722fc195debfa0985f
SHA1 2dd803729bd21cbbb672e6799ee7b80ed22c2e0a
SHA512 25f965a5c8da5eedbb0d7a4adc0314316440a8cded53947ec7ccaabb3d08b478d29855630254412a06821b427f5108991f7325fb17f79ac43315a3fc4a740f57
SSDEEP 192:nq7kz30ZjGWMkuwhwSvZGSFSXYjqEP20wHrg:nq7s0ZSWtViSMw6qH7w0
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 d05bf1f6f4adf06f0ee6d8797b9eb88b90371b97cfba66bd400bba2a9de5d9f6
MD5 c467c46e3237e6cf768758e6fd3d2da7
SHA1 3885283cf44a55be30ff82e7dc832f06aae6ea1c
SHA512 37f4496e813f787620be619978ace3f8178893447fa6bd8a62d310190ffa5016423d0b22bb19738bf24070e1dfe0b7d5efdf7355fc5d2ea598d96ed839f96631
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58ac87.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58ac87.TMP
Size 203B
SHA256 17574d6f9b8c6cd5b30b530c20948b3b912fcda4d9a90fa8b3a055928a47130d
MD5 7929209c0c7ebfb6a7fd48e232bafd5e
SHA1 fc06949413b1d8e881e36e32b84419bb77bd3d37
SHA512 36171a8126fd5a9e21730844093e7f5f933d7eb0c4761dfe2495e29aba2b0242b2d73aafbcdbb9fb8932aa287560ec8f9a7bc2d97ca3bd850250121617666513
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 54df1b1cac528b1d0c8b74958a08f161bccebc4d02837f8e89c95d38574af708
MD5 80f58fb5f3f6ede1638e76abfddee968
SHA1 3a7a798e880860362c6d772745ddb359121b764a
SHA512 6b454299b0e1dbe5352c6a01fa71f7f7f3059628be61181adb53dcb7d2d419888bd740fd03c7a17c68b2c0d39728db382cebf0e4c84174ec58a1bdfba86e336c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupcbe2RU8Edc6lYOr/ru8z8n:A9iIxuERzA83h09RZxYcLREdc8r/Pz8n
MD5 SHA1 SHA512 SSDEEP

Submit Download