00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc

Analysis

max time kernel
142s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
30/04/2024, 01:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe
Size 36.0MB
Sample240430-cc4ysahf2s
SHA256 00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc
MD5 f205864b3fd0679e60b2076f84890f86
SHA1 3cbcaf69c4a8ad3d1e8e2a94076ee93f5c7a08fb
SHA512 c0a045b7b1f79e5a6bfc1a9633f81a33f707f03ae7ae664652f06b23a9a0d1a6896b7837e60eb930b5f8cd33389fff5773f6097c8925c31bcb923a36ac4f1a25
SSDEEP 393216:inAqMInoJITfRwF6+YPlC6PIwt4jNQTXh7ywYzTcDxvVRzzWdtMPD9Z:in6iTfRwFOxostywY3cDxvVNyaPZZ
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 587228.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe
3604	msedge.exe
3604	msedge.exe
2268	identity_helper.exe
2268	identity_helper.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe
6024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of FindShellTrayWindow 59 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2832 wrote to memory of 3604	2832	00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe	96
PID 2832 wrote to memory of 3604	2832	00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe	96
PID 3604 wrote to memory of 1296	3604	msedge.exe	97
PID 3604 wrote to memory of 1296	3604	msedge.exe	97
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3596	3604	msedge.exe	98
PID 3604 wrote to memory of 3464	3604	msedge.exe	99
PID 3604 wrote to memory of 3464	3604	msedge.exe	99
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100
PID 3604 wrote to memory of 4448	3604	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe
"C:\Users\Admin\AppData\Local\Temp\00e9d52d5f3a16cf0ea7f07f447d03c040a262d991630202697a09ac8137aebc.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.9&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xe4,0x114,0x7ffef55646f8,0x7ffef5564708,0x7ffef5564718
    3⤵
    PID:1296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
    3⤵
    PID:3596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3464
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:4448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:2476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
    3⤵
    PID:1952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5004 /prefetch:8
    3⤵
    PID:4124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
    3⤵
    PID:3376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5580 /prefetch:8
    3⤵
    PID:2728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5520 /prefetch:1
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    PID:3132
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6196 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6208 /prefetch:1
    3⤵
    PID:3476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
    3⤵
    PID:4360
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
    3⤵
    PID:5248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:5256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,2504846510821624402,16408176303014583059,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5012 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:6024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4396

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2
MD5 8b2290ca03b4ca5fe52d82550c7e7d69
SHA1 20583a7851a906444204ce8ba4fa51153e6cd494
SHA512 704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141
MD5 919c29d42fb6034fee2f5de14d573c63
SHA1 24a2e1042347b3853344157239bde3ed699047a8
SHA512 bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 2b4bd21dedae677b85b19da413f9c9b9a3d568ccfa7da4036085c3650eb2150e
MD5 76119bd2a5e4b9f16624ec49d4cc4e64
SHA1 63666acffab38135a6f89eb61814f42d94fd9ba2
SHA512 9021c3ece24294d3d3a5ee041870953684a906421227c83f349660c93d9bad46af02c8c4ab45cb35a0a80421a7e614f1a01af86293706f01860c7adb338c5c5d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1002B
SHA256 ad4a3e49fc860cc5f266274949d4fbf920fdeb8313d5eee0c1cc0be2eb131294
MD5 13494cfe9e61d1f7063baa0da4b75569
SHA1 b1e929123bd5983478b694ede05356c6735be8ce
SHA512 4e5f0754c652b119573ee09fa9c88a01f2dd9ecdc7499e4b772d22af2604fbb9bfa1a40c702bca870240db8b3a56ed1aa61b9a69ef318567a0bb2b7a3fffa7fd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b41fd40392c6d4850b6e2f3a11e79c58d881d2d2931256c2a65a1fd68bbf3d68
MD5 5879807dfb801f46b807132117e3d5c6
SHA1 8ba984c2d7565fe3ea92b43f883ca7db22d32cd8
SHA512 f4903bbb741a3dd13a11c2d3c7071476c2b1a2657d2a34bb89e31840212f873a862876bd8941caa75ffb1988a6b6f351e8343f13b7af199a8d78ec815f23ee81
SSDEEP 96:nSk8sQHxm/DnmqN1Gdij12wpvWMoiVmdeziuO1juwEtl+UWQyV+VD7AiEwb:nSkz66ggEGWMeuOhFgl+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fd97fc9598bdbd429ca8f6fc0eae3ecc833f54eb10708d9171b7bcbafab9a8ae
MD5 b6544b2e35941524958a6b994f909461
SHA1 fd1d96c0ac0dec6ddd9f38538b2adf9ceecbac3b
SHA512 d8a482c8bc0af45945e2dc8e3d0b9c80a4f3047eb6d9514757d81f5f16bd32c7450490cf9d147f4e734ea6ce1297554ea757f474aa82a35310ca994b0ae095c9
SSDEEP 96:nSkJxm/DQYmqN1Gdij12wpvWMoiVmdeHuwutl+UWQyV+VDCziEwb:nSkSI6ggEGWMXF2l+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 784f8fb8ffb919053b2054e49926e9d0a8cd78fdd8ceeddece63c3f3fd11c3f7
MD5 e3970a75570696a504a80374bbb1a82a
SHA1 d04e2ebaf848b515fd41f1f9379fefa97c543df2
SHA512 df561b4eef681b3f38958aa48ce540524f96680f93bb3a6a1be15e817f051904e3479da7549b9b4ec5870832032509f65db21db7e5e4c86547d4099a9dbecbd5
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 21488b4003ada576a8dcacddc076ccd252900e9e7ee8f70106ef22f1d393fb0c
MD5 584db365e03276b141ab2603d2de1877
SHA1 1e73a9d58446c60230bcc6b9be44cb0daa6edbe2
SHA512 18e99766380c4406b6c166cba8504f31ab96cdfc89ce988cb6ac2af6212baab6a357ebd96dcf512973a7eb148f4c0ce4c26138b11d6dd6645137b395addfb54b
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58751b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58751b.TMP
Size 537B
SHA256 8ea43b5f22cffda98fb97c84b04dd84f7af205b733ec9d663706033807659421
MD5 9d3a2c8be5873ef05ea81aa4e9375319
SHA1 702b234fe0151e4b4122681bb94f51a03808ee57
SHA512 6381e217edd75b1c8a7838bbeccf60f3b8a48783ea1c34a64695358276fc5840aced55b38f5af00a317fa2e920c09c236618f5a0cb544f96d90b94dc6ae435af
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6ab0cdf867994963bd789f7d4effa8ec533e4c2e173e4fc3aededc664eb67421
MD5 79914edaae0624f71d3526e99d337b05
SHA1 a341fb7a1daeb6b968f7707b2611c64d7e32eceb
SHA512 5b4029ef345753d14635364e4945978851c1402cad3e4c40e83dd3296a67693762c061f7d730f261126bd7b0a8b0bfe82463405405ae2be7128cfa4f3c9da3cd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup47Me2RUgIz7po88dylluDz:A9iIxuERzA83h09RZxY47Sc7po8aPSu
MD5 SHA1 SHA512 SSDEEP

Submit Download