97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63

Analysis

max time kernel
140s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
20/05/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63.exe
Size 237KB
Sample240520-bmal9acg79
SHA256 97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63
MD5 06631aae6bd22f966a4e2bed2f90e3fe
SHA1 f50a696e844a39b09647bc1d984224794dc0e70e
SHA512 bd30f0c49b6a0986d68dbc74e5554a8a993874fdeb85850d63db33251335dec8304f30d63350c299c5e7bfd407eca020731abaecb9337e9421bc6f84501785ca
SSDEEP 3072:jVX3RRxRxirCB51LnGmfOuZ80cRK7rO5l9l20R4:hRRxRxqS51LnGO6Vs3Wl7R
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3332	msedge.exe
3332	msedge.exe
3208	msedge.exe
3208	msedge.exe
4136	identity_helper.exe
4136	identity_helper.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe
1136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe
3208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1280 wrote to memory of 3208	1280	97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63.exe	94
PID 1280 wrote to memory of 3208	1280	97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63.exe	94
PID 3208 wrote to memory of 956	3208	msedge.exe	95
PID 3208 wrote to memory of 956	3208	msedge.exe	95
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 5012	3208	msedge.exe	96
PID 3208 wrote to memory of 3332	3208	msedge.exe	97
PID 3208 wrote to memory of 3332	3208	msedge.exe	97
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98
PID 3208 wrote to memory of 4832	3208	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63.exe
"C:\Users\Admin\AppData\Local\Temp\97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffe3546f8,0x7ffffe354708,0x7ffffe354718
    3⤵
    PID:956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:4224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:5032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
    3⤵
    PID:2268
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:3108
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4136
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3616 /prefetch:1
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:3452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
    3⤵
    PID:1932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3820 /prefetch:1
    3⤵
    PID:1344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,756713869590394570,7462332270048055699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=97e8b69225afd0d60a5bb697574c323be9042486fe0838d212ba3af6aff90e63.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffe3546f8,0x7ffffe354708,0x7ffffe354718
    3⤵
    PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 1a0e90d87d0488c5a1b36c356e062edf8f7d4888aa1f74adf3d27344b10b4b09
MD5 49169330fd73b8a544fecc5ba4f53760
SHA1 26f21af7e6ca180ceaf01393836245143a7e05bf
SHA512 5f960fef0a53f07f574a543b18ef764029666cf70c653f13e051a4fafb99ebb8cb9a8aa8c390f511554a8c16a459e07f0bcff0d0cb234c4e977efb4eee84d78c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b5fc246156f0b3d8a39c8c5339dae2d0305efc75d1a5f31bb3fb313017c254a8
MD5 97eb9ccc17a1afe8d45dee3875402f4b
SHA1 17464e7f18693936ac37a966a1b932e367c6fca9
SHA512 89fa2629bffcd7cc81de501f4f62004f7e5ab771deabb16cf9946d61b74fcc00b513e955bf85df9221e08bf79c8b5000f1c1762c32b934a1231377c2d2e1e06c
SSDEEP 96:nVkKD1C33XwpvWMoiVmdeHp1kvDgUWQyV+VDCziEwb:nVkEUnXGWMXpKcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 972f1548bcd179862ceade159c5190b573f11e61bf6fd8bb483f7177578041a6
MD5 0ed492154abeb620e20d67061e6d1561
SHA1 f637d1a86259943b43684740a5fb11ddcabd3669
SHA512 38f549d29f8574d938c5c415eba7d51ff82dda86408cb98ade4fb7488ab15e082bbc54c5330fb3d5d936bb1c2302f9c1b8d7f3a670e7e6b3b92a31918becba10
SSDEEP 96:nVkhD1Cn3XwpvWMoiVmde1LuCS1jp1FRvDgUWQyV+VD7AiEwb:nVkhU3XGWMRulhp3pcrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1ea03a1d0403b5aa416eb178a46f1c1459ae9ebd73faf8d5789613b94b82584c
MD5 f1e1acd61343b7b9a98c50df23e7ce35
SHA1 4876501bcbebbc2ca16cb2fae8c74a2ab90fd282
SHA512 16a76a089305dba5f23d4df96dc10d9fd22a87e7a80780e59bd218d7294f7004150d00c8025c2d69c7d26e019fae28e9bd752be294cb93a1996fd5d71a0a8b7d
SSDEEP 96:nVkhD1CU3XwpvWMoiVmde1KYaMkdf1py1KvD2UWQyV+VD7AiEwb:nVkhwAXGWMYYaB9gIirg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 fa9475a69a26ca4b9b6fbae733be5ad769e919d5ab2b4d94a1398eb2f065e18f
MD5 83766b1434023a170ad4c2a3328d0e38
SHA1 717009bc699c6ede276c42083703ee005d5c9299
SHA512 9daf0adeb51836cfbae0446aa62635622836f1187656556abfb8ad97acf7fcbb14452d8ed4e2cf5108dbd43a54f590ee0252501e98aa35de758c1e2592df548e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57adb5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57adb5.TMP
Size 371B
SHA256 9ea4dee9d3bc6228b9d1621f5fe925f4390ca9b96fb455002104a6ea62efcb6c
MD5 e383cbb5f4558c59ff2b598216aaafeb
SHA1 7cdc7e7d28b7814ae2105babc6f42f4b72fb5415
SHA512 f2c1d8a8ac9108ef765f48d952f21265504fae0c9136845256ca16115ac5a07b1979f7b8e4f4b852621b765fc4f0686a7c19a80967fb0a2122cfa65eb55ece13
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f7e6cedf35b8528a34acbd6058bcc20c55f17b292a8987ce4589686225458aca
MD5 5012a6dccceb6ad34d924d7de56b91e7
SHA1 b4ca93bdb861afb3268425b0498511158b2a633e
SHA512 33070e1407f958fc94cca11ff95d34c6460c33a401463b0da9b5b6b3d57e262d734e040e8892c6ac04b5718fd3b97c3cc5e93a256d0e7ffe1fc35b6cfacba259
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi7Qe2RU1ho5Q+OblfBhDaw:A9iIxuERzA83h09RZxYiKSqQ/XDafEBj
MD5 SHA1 SHA512 SSDEEP

Submit Download