f84661162bf98ea330c076195ec049d1d59620f011a88fb7afc2f3735045bacd

Analysis

max time kernel
112s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 11:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
f84661162bf98ea330c076195ec049d1d59620f011a88fb7afc2f3735045bacdN.html
Size 81KB
Sample241017-nenv5aycmm
SHA256 f84661162bf98ea330c076195ec049d1d59620f011a88fb7afc2f3735045bacd
MD5 5d344bad2ee425f18043c41cc0564800
SHA1 136dbda5d13b749a26b6834bf170f8c400e4c261
SHA512 083e4f6c43757f34f4efa89002b343e9d58931258da656a3801e20a0c2f5df17836d77a152efc2e308823a26c5f60caa7d3b2abd8f33af52aba952793d329e41
SSDEEP 1536:2VjD2TO+q9oOpCORSwYnvvoygy2ODB2fnaCWdT//FQLSn3VNSI+K4QBabffy1L1x:2VjD2anpCORSwYZgy242yCWdT/dz+uBx
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
1372	msedge.exe
1372	msedge.exe
3028	identity_helper.exe
3028	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe
1372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 4032	1372	msedge.exe	84
PID 1372 wrote to memory of 4032	1372	msedge.exe	84
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 2520	1372	msedge.exe	85
PID 1372 wrote to memory of 3592	1372	msedge.exe	86
PID 1372 wrote to memory of 3592	1372	msedge.exe	86
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87
PID 1372 wrote to memory of 996	1372	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f84661162bf98ea330c076195ec049d1d59620f011a88fb7afc2f3735045bacdN.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8236046f8,0x7ff823604708,0x7ff823604718
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7172 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6660 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17673614503346169113,2370016590994993490,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:4800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a
MD5 dc058ebc0f8181946a312f0be99ed79c
SHA1 0c6f376ed8f2d4c275336048c7c9ef9edf18bff0
SHA512 36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be
MD5 a0486d6f8406d852dd805b66ff467692
SHA1 77ba1f63142e86b21c951b808f4bc5d8ed89b571
SHA512 065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a
MD5 SHA1 SHA512

Submit Download

f_000015

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015
Size 20KB
SHA256 7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191
MD5 05197e9427acea2ac4dc812f97a8f078
SHA1 3d2a38b79da52e57783360f195ac3e7c85edefd8
SHA512 084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead
SSDEEP 384:wPSxXxKeJEsjg9wbw1t33eVliNGb3naaE0QmTtcOJv4FYUdrAd1bzxvp:BxjJZM9YYOVliNGbXrQ83ODABdvp
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 881e65dfb7d5b29120d0647a27a8d00b6b69321efdec83ff342782083f5350c3
MD5 97884fb4334c5debfc06d52445ce11dc
SHA1 b367e5917692bf4d12e6a2166b453ecda59ca6a1
SHA512 bd4c371bf9e4f694fb0302c802f5d6fdadf072d60fe28aafc2a0f909214441f56ba827db6a0ec6dec899ef72716474913d4d7d4122a00d7fcb1a3e7561008c70
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 5bb7f3af27c65c260f8976d035efc76d6f541ff379f99ec55f72202d6eb4d1fa
MD5 ef46e3b9ac8d486d98dca86b20248e23
SHA1 cc720b1036ed7d9883603a062e49c0f6d7c5d068
SHA512 535d2bafc628c3e0288b5f4c0269dfda426be1be8a6d04b82fa5bc3d39709112b3302b05f74f46721f629a93fce8a9363d3f50a6100da86c5448413ef75dc20b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 bd6d95ea9ac0f6777777c8efa31136efd05e6442935adc4d2a35461fbe0300e1
MD5 4226b49315416c397bde279ad6b5b0dc
SHA1 5ad18434b9ee6f33e7b13b7a5f134540aca6b11e
SHA512 861c47908a09b5641e55845fd818743ca6f05e4497b472e88b3bea5276e64663fd950bbb7d4fa8ee6fb3b40f4b9fc2d73de4d86951a7ad60cfbf405b2354fb6c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 fea469178a94bbbf6e70224f80b50fb3c07fd06036f90ca06d5aabc77475f865
MD5 a82ad6f5be5fbf43d57b08496cc69db8
SHA1 44973d50c6b63f33a0368989052c97c68b2eff7f
SHA512 55e525e86aef86f7226c632e8da4984621cf26e8cba71fabf4beed95a6e05b2383f6280c319b8167b1ce34ede6d2dd2a385790a4b4c85c6e0fa5ef54ca71e414
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 a31ff2cde943fd6ea7dfdfdcab0a751ea20ea1b0f250a4c9a7efa421ce026e00
MD5 948697d4d6757d4ddfed4586dd199893
SHA1 a980e91e079020c2672d558276eb6b022fb3db25
SHA512 fe3dc17e01e6833bde502c0f877f37341df03926ea28e0dcd735d78eaae0e2e24d327dab0d88dbe54439810af0ce3975fb7c4db11afb2a20868629252e98eb9f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 47bfe3cbab1a8702f5d9fa19091a23a2dc8632711c83571d3d5f1da7eb9805d8
MD5 e23655198b6bc242474350aa27819b26
SHA1 ef7390e922c6e67818b60e7c299538e15db1ec4f
SHA512 a7d56fbffc95af83fdee7ac361ed34942b2595dbbb10fbc837e8cf286bf49b34997e7263ced98e795d3817b1e37365774de459c8d5fc92e3765d16d2bf09d43e
SSDEEP 96:ntkE/1G9wpvWMoiVmdeH5edUUWQyV+VDCziEwb:ntkSA9GWMXsUro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 ab7cdbe9f728af24346ea8e311f8129d76d7abdb7a81fac24373962c6a4f5a5c
MD5 72b558f4066ed909d1ae165ab64f49b8
SHA1 1d1e50e2a1d35467522e1bdbb3cf0865e0aaecde
SHA512 330f04955a8e91047f59ce4c88cc52e2cd8a205e48d65bd56ef2f288bbf216cefad670d27e31b1a4fe08e9d3e04a099b659d602265483551b970c060e94f9949
SSDEEP 96:ntkO/1G0wpvWMoiVmde60pNDvmBy+B9DX25edUUWQyV+VDCAiEwb:ntkUA0GWMK0pNDvmBy+B9DX2sUrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 99765a10fb299f28d681a856dda28ad54ae2d05fe98c98f0c11e632dc27a5b9f
MD5 d1eb5afbbf6bf48aec820ab8b0fc4d06
SHA1 b7228dcb6d57daf2a931aa3f1a58b67fef5bd3c3
SHA512 9b07b610513411249890e2cda0ee722e457c4d8c897d8eec8b51ac9cd3ceb56b8fee6d86fd09d6788aaf3f51853ab8a3c6a7c236f05d7cf91277494ffa41ebd8
SSDEEP 96:ntkq/1G0wpvWMoiVmde60pNDvmBy+B9DVuX25edUUWQyV+VD7AiEwb:ntkoA0GWMK0pNDvmBy+B9DVuX2sUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 7953ea7ed5f378a706faca887dcb63eb0c21109303c4775a2cd5a2e8dd28048e
MD5 64ccb819d7ac05ebc241f9ddce9ada22
SHA1 129c61e6a754463f1015b656a0682949f58a5c2a
SHA512 913f2d88f10acf838fa7c9ce95d2c49b4cfa6a68c0e9ddaa09f70b06f7d8300200a53314ff1e614e08d0c0f2567946db4ba8821762216ea1d9548222dde977e2
SSDEEP 96:ntkq/1e0wpvWMoiVmde60pNDvmBy+B9DVuX25ixdUUWQyV+VD7AiEwb:ntko00GWMK0pNDvmBy+B9DVuX2oTUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d97e62308022669889cb88d709cad27bb1a789e83e1296fee95229fd8be9ca07
MD5 425f6e91bcd90ac2e7df9cbfb379f41a
SHA1 990e06b4410ba36215405c1e3ce73eed4c62d348
SHA512 1eddc7bdff98094abc6a882e5428c325c7c50fe2bbb49703aa27f63047c65c662bc678c6f60e91236dc942d6af408b11a2caf8f7fef9cdbed2d63c6d5daebb46
SSDEEP 96:ntkO/1G9wpvWMoiVmde6NDO+B9X25edUUWQyV+VDCAiEwb:ntkUA9GWMKNDO+B9X2sUrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 704B
SHA256 6ae4fcc98db236fdf457be2c800f6f943c3cb7a5c411631dff8e194f8f78318e
MD5 8addb0242810e9a656a234085ef25c2e
SHA1 d9f0af0fd74c73b0644265a3ea70ecba0fa5bb25
SHA512 75be3ba728a3f14f45817def2d20d5f932009386e31f683bbc149d0e74247c0b783811197228556206b4c8d6e62b1ee57def1dc85e7b1694c09cf3edf769f7ba
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe581ad6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe581ad6.TMP
Size 203B
SHA256 570e08f00df8c10a41e1de6b36ad7f80b3a5220f84d6fb30c7edd29aa6368363
MD5 0465dd536dcb549f68f49ff788e21fe5
SHA1 3befe709bf4aefb1fad3f80ae1de492a7b9f514f
SHA512 68c2ef7352bd7de92fff3d53e374469bb5a2975086703de2e0ed0f6f8d5ec5350830ec1631e7b84729cff36555b330489866d99343a578b7bfe15af09173e208
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0871545a2fca652876fe5a82309efe3c2e4e704e584cc1ffe08950903184cbf2
MD5 18453a2a3f06b18f6904402fbd073411
SHA1 7786d9d867517b58d6d4e21576bdffcfe0f110bc
SHA512 39c99d805c0a18e3b89759162961f43898c8fe95e91ba10b06d5cd18cdea30ff0306691dd37f63f66425b22884319df7d7233fd7696370da410901e0c132849c
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTe2RU+Lkyoc1K3w2muu:A9iIxuERzA83h09RZxYDL6oKsuu
MD5 SHA1 SHA512 SSDEEP

Submit Download