b20b5fdf00a63580a491d6d75aecd6fe5289e46d30e6f46a2d62a1d1e663c1f7

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
09/07/2023, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
28281120x0000000000270000.exe
Size 192KB
Sample230709-tekflaeg5v
SHA256 b20b5fdf00a63580a491d6d75aecd6fe5289e46d30e6f46a2d62a1d1e663c1f7
MD5 45ab7884d69468a2b3458d1e428e1bb7
SHA1 b836486140a704c5517e0752b539761b67d18ff0
SHA512 244caa2017121226b428704ceea0a3143fdb75e1ef6d7a5a7a00f2ac241cbb64e65d1373f12a31da86e51a84162db0a66919128bd9151894fc6be25473dfb78e
SSDEEP 3072:YO64zyFlJDGx0HqSYxNXUfMim4G328e8hE:sf1s0HZ8em4G32
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
4112	msedge.exe
4112	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe
896	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe
4112	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2636 wrote to memory of 4112	2636	28281120x0000000000270000.exe	89
PID 2636 wrote to memory of 4112	2636	28281120x0000000000270000.exe	89
PID 4112 wrote to memory of 1724	4112	msedge.exe	90
PID 4112 wrote to memory of 1724	4112	msedge.exe	90
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 2660	4112	msedge.exe	91
PID 4112 wrote to memory of 408	4112	msedge.exe	92
PID 4112 wrote to memory of 408	4112	msedge.exe	92
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93
PID 4112 wrote to memory of 2240	4112	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\28281120x0000000000270000.exe
"C:\Users\Admin\AppData\Local\Temp\28281120x0000000000270000.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=28281120x0000000000270000.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f78546f8,0x7ff8f7854708,0x7ff8f7854718
    3⤵
    PID:1724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
    3⤵
    PID:2660
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
    3⤵
    PID:2240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:5044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
    3⤵
    PID:4400
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    PID:3196
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5212 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3696
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
    3⤵
    PID:4520
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
    3⤵
    PID:2736
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
    3⤵
    PID:1820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --disable-gpu-compositing --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=2 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
    3⤵
    PID:2204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11573814707425357471,10888718744374441338,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3144 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=28281120x0000000000270000.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f78546f8,0x7ff8f7854708,0x7ff8f7854718
    3⤵
    PID:688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4
MD5 70e2e6954b953053c0c4f3b6e6ad9330
SHA1 cb61ba67b3bffa1d833bb85cc9547669ec46f62f
SHA512 eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f6e770a3b88ad3fda592419b6c00553bdadc50d5fb466ef872271389977f2ab4
MD5 70e2e6954b953053c0c4f3b6e6ad9330
SHA1 cb61ba67b3bffa1d833bb85cc9547669ec46f62f
SHA512 eeacb0e62f68f56285f7605963ca9bb82f542d4e2ccc323266c08c9990cecdebd574e1ab304ae08ea8c6c94c50683180f83562f972e92799ebbcfcd8f503fb5a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 312B
SHA256 a01d0ba3a6c1925a5109d88bf07d0d1915fa3b0efdd5769a16264f928030b660
MD5 13efb91601904161aa21eec4f59fb803
SHA1 f84cad09e02f2038723965c4d86ccf0e4918dc14
SHA512 9ddd5a0674d91ee01a62343ad42079b15e7dcdbe471ae6cb0d8d7f861822819b5a18876d15038fc25da60e9bac488b36d9d40099e4e00f5b95174abd08851b7d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 346B
SHA256 b8193a8bbd8d5c6b71977d040537ea555fc414cb3f7c2d4166e9bd3ac1ef4e89
MD5 172a03f1e073cbc347cb5102d038fa13
SHA1 83a95a02491a4b046ea79fd04ccf6c5c24b29d60
SHA512 2a47a09a51fbf77f8b2bcc2d3e46db628d45ebabb9bb4033965b3409810e9a6c55c1008a62bfab5d3ca2a64d8b67f5c726f3682da0132738065c14ff77c1f5bc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1ee3683da3dbfb4d4504338840d12e4d2fd99eaea78c175adc79c6aeff77a42f
MD5 a52345489b4b0d97655c033fa69069c1
SHA1 485fcea4c1b8247e332db42c4ee4fe8cb7e19183
SHA512 44ceaa00e42f70852363e7141dbddf176a35d36f0e21e1dadda16b3d8845c939d26b8d854574eb07d96f2169d183b1612cf99425cc0fc6d85fe2c68d507e4dc5
SSDEEP 96:naskIYgm/shmqq+1BCshDwpvWMoiVmde14EYaMkdfdFpDC9J/ZMTl2UWQyV+VD7l:n/kRD+jphDGWMrYaB/FoMIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 88ae5eca09394d7dc4efe57104f16570fd82d6cfafd9f3426a16fc202cf323f7
MD5 f2e5d5f987cd58da02bf33a04c810e2c
SHA1 da2a8b3b9bcf97c5a5a12d973863ef295dc57541
SHA512 f7795bfbfaa6543374ec95bf2ae46b87564a58a9a7a0c364019468f5c0c21bddbed532183b19e061e4a5fb6a18aa9d52c032aa976b26f6c50cf33d7dd7402344
SSDEEP 96:naskIYgm/shmqq+1BtshDwpvWMoiVmde14EYaMkdfdFpDC9J/ZMTl2UWQyV+VD7l:n/kRD+jahDGWMrYaB/FoMIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ce732e30e8e02809f3461a720547452ccc4f49cf485a9059d6e6525ae3827122
MD5 7d2ce8ed9a25432b9b0fbc44c3de6945
SHA1 d9191a960e3a6afe365fa4914503e8eca49dba1a
SHA512 7969c8123db6b2dc2e67be50b5e1b919d4303c5a29f20dfe54f1cd6d96bdc5bcbf368c66249560af16030e051d136010c4d8081d04b11d29443589acba1fd3ec
SSDEEP 96:naakIYgm/sQYmqq+1hyshDwpvWMoiVmdeHAC9GZMTSUWQyV+VDCzia:nNkRx+PZhDGWMXATM2rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 665cf5612c61412c9acc928b1e155c8f11ae83905ce614d9a1a7ad72cc0fd489
MD5 5a478f1e08816969e8214f982850b754
SHA1 1cf5e7192f3c6e31c7e27b6cb34ebf89036eec0c
SHA512 7e7ff60c157841f6f5bb206ebbce29f6df3a6c0c671805415ad7226654e13da49ad76e39a6d0afe28992348f3b5685ecacbfb44178fd61998c54caebbfd97832
SSDEEP 768:n/IkwTnWCBat8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJWLl9sDI7rUtEAjTID:n/IkwTnWCBatu1jayWLLQI0OD
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 a33960ba9dbf361d531d2e6d6dfe2e99470a0aae9a2825ab1a91509cd17d95af
MD5 42bcb767aeb22a851c945a932d5d9c1b
SHA1 b9da6f226c85ee42d6173b4f5c566fddb63e7327
SHA512 872583184db1fe1e47dd63cc66fbcbde05d5a8975e2a970760fcccaa917abd8e8e9230d3da9e2c2ab63129747ed507460f90bf5c18179e59d41efe1dc61f79bc
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5848cc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5848cc.TMP
Size 371B
SHA256 37606711ac3e3e00eafd3f6becae460f9a770a4d17932c48b8e43f26132b405b
MD5 8d30afc227fa75b5e28a86cf577e385a
SHA1 50d2d2af726454c83889f2765ecf7415c08c4fef
SHA512 ec6ad8b0afa87814f23495b38419dda2b611c8ada6e8f37ce709c1ac5fe83bb840ff7f9f6dfd4ddd297476a05485f51a694320b8954f55c1c7825cc61a2d7f61
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 39cf62bdadfbd2c95878ef73e7c844506ae5a38cd0f781fc2725fb60698aec8d
MD5 2299e9eb03c97c0178da656f600e1185
SHA1 17ed7b9a01252eaf56b21fb303c8aa8d84bca238
SHA512 1666fb95ede52ff5ad18506c3189a03b662f5932ac2c8933bf91ff4c2a26b74bff27c09202f7546047f34f32fa85ed6940116887948ea773aed6a9d2ee1de3fc
SSDEEP 192:RoCL/Pgu90RZj8g6FA4ZiIuERzA83h09RZxAexuExZaKte2RU/SubD8iCr+KyrWF:n9iIuERzA83h09RZxPZJKx84l9RHvUD
MD5 SHA1 SHA512 SSDEEP

Submit Download