6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a.exe
Size 236KB
Sample240516-cb7y2sfe68
SHA256 6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a
MD5 a5fbd64056fbdbd6c7437a49b0874c94
SHA1 4e00ef887d492c5376b6232a9a094ea35dcf1e72
SHA512 d223e4c460e6a34504893e37f0014f5b3186e0288ca0c1d2a2b863ede5372df3de412da71abc900301119ea7683973eb403207156616b654223f30cdf67c649e
SSDEEP 3072:IekQDZhRZJ1pczOYqkvM7MJl+I1Bt/MT+d9ueOaGq51zhQV3sl:IrQZhRZJ1zaxn+IRU+W+G8hQF
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2268	msedge.exe
2268	msedge.exe
4680	msedge.exe
4680	msedge.exe
2924	identity_helper.exe
2924	identity_helper.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe
4188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe
4680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3456 wrote to memory of 4680	3456	6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a.exe	97
PID 3456 wrote to memory of 4680	3456	6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a.exe	97
PID 4680 wrote to memory of 2276	4680	msedge.exe	98
PID 4680 wrote to memory of 2276	4680	msedge.exe	98
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 4636	4680	msedge.exe	99
PID 4680 wrote to memory of 2268	4680	msedge.exe	100
PID 4680 wrote to memory of 2268	4680	msedge.exe	100
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101
PID 4680 wrote to memory of 3176	4680	msedge.exe	101

C:\Users\Admin\AppData\Local\Temp\6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a.exe
"C:\Users\Admin\AppData\Local\Temp\6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a01846f8,0x7ff9a0184708,0x7ff9a0184718
    3⤵
    PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:3176
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:2252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4112 /prefetch:1
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:3524
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
    3⤵
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:3548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
    3⤵
    PID:2672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,16439278102399563717,8848048100225812378,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1892 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6698c56d327448d1516f283681dd1eb741f08a31c9b20a4eb97f7a8b15da2f7a.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7ff9a01846f8,0x7ff9a0184708,0x7ff9a0184718
    3⤵
    PID:4544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 1e7274ffe47961c9a2e3abd5ff266105d958a3c56a5d111bbee662a0d9ce8966
MD5 2a913ce514a0e7c5eca47157d6094733
SHA1 92d21450f9cc348158a331b59277f973edaa0ea4
SHA512 e13f77f5e674da25ed88c76d7ae2bdf65fb06f3984a5ba49d2a115834acdc754267f41d29289b23a0da030c84648fff8e023735311041cf0a583d7ed2aca5472
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 47105713769359f29269513e807964ba37813be4230d7a65b643f06e9ef4371d
MD5 196aefc49ff1b28137921081ff23bdca
SHA1 0dca23db7fcd04e2a6a809749d1738e63fded488
SHA512 03beb5a52e3659a55aebf269e77a417f97eb1c95332793df6a5e9b1240a4c513227e7803eb9d303dd36251b64980677b4e6017666b11dfaca512c0c298e45e36
SSDEEP 96:nO2kXez1Tne8wpvWMoiVmde1IumS1jpw8g4AVs+UWQyV+VD7AiEwb:nO2kuzdne8GWMKuRhpwJy+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 adaaa2cd233943a02944902990496e88b0a85fc246ce137da51d541c2f9371f7
MD5 4109dce18c443eea9c4c9d8f7a69bb50
SHA1 5c70d410ce0fc05ed1df2da37b73de0c2fe6fdbc
SHA512 ce25ba0ce6d97e12b7ef91b7afc214f10b707ec51550f8fc7f59c690336164d161662afd1036a716e2e03b02f6f603184325a60cf414751ba07211490a44fc5a
SSDEEP 96:nO2kAez1T3e8wpvWMoiVmdeHpw8E4AVs+UWQyV+VDCziEwb:nO2k1zd3e8GWMXpwfy+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 313e1dbafa307fc8ee57ee730b6b2ba89cb69dad0effc0eb74f92f13c3ff7fbb
MD5 dd5244a12639455df29371fc4590f479
SHA1 6c3bb7650bf793b0a91365a807cc53f7baf6ba20
SHA512 ad76f2b6b9c0d80e329107498ab7f0318b152d4cebfc12b9c560558049f065c2c1b2a049b0ce659ff2d53ee9d804b56128e4a18cf06477397bf502d2043086c5
SSDEEP 96:nO2kXez1PEe8wpvWMoiVmde1HYUMkdfEpyw8v4AVsPUWQyV+VD7AiEwb:nO2kuz1Ee8GWM5YUBcgwoyPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 de87f473d5c6bda977ba3dfbc13f049dece4485caf73481e63140b6b8979501c
MD5 dc096e46de0b2a95219ce805cd3816bb
SHA1 6f659175c57c4ebb179058ebe8393e377a32c61f
SHA512 b2577aaba1f796d9a9a9399c2719a814dc74e1ef790a22b9b82605c8b0fe603f5c4e4a836d319799ba292e672b03f909ee9486bbc7e2dda1b34e1867c054b7f2
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a9fb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a9fb.TMP
Size 371B
SHA256 8efdf95348a5a7d0e09962f5a78376c451dc5baf7c17e6a65b42988c3e1edec5
MD5 a718221ca3b41ffe48ae98ff13057a74
SHA1 85a58b43a1a634be13161ffae3ff01b36a0d6eef
SHA512 96f8c5a23926117cf045fdf738963bd38ab1c14454c2123a6a541c7ed22b91ffec4b5a3ff28661bc6b6eaa76c42cadeb73f3c10466565b4b119a87f904533276
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 e25163aa1a2c5d967c16aa7961e773e598b894591b5930fc551bc739fc987506
MD5 d58bdbdd4330416e27dd6b9f75cc764c
SHA1 d7a188f1f06be95407e3e26df2ceaf021351acaf
SHA512 3b2d48d6eb42becd48dcaf45cc1fecdb559d625bbed22a7b86f779656f2ddcf50d0eef926c33e809403814955b4d1ce857e0811bb620f7fb7a56ffbdf85b25a0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjMne2RUjJ+kQ+OblfBhDa4:A9iIxuERzA83h09RZxYOgQ/XDafEBlB
MD5 SHA1 SHA512 SSDEEP

Submit Download