00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1

Analysis

max time kernel
141s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
24/05/2024, 08:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe
Size 38.6MB
Sample240524-kpr4rabf84
SHA256 00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1
MD5 86d53411abc2b650a08715b57c62701e
SHA1 f8ca452d41df2455409f0503b268c936210ffea8
SHA512 4fa6f176d1423f34a7bf5fe249aa61082396fd3804a8bd87e7214e0a4331a39abf6a444dd1528e4546e6ce713cbf6a2e39e73922e0afd69543cdcd55fbfe6d75
SSDEEP 786432:aan6iTfRwFOUPofAl2jtyfJscDxvVUyaPZC:Tf2VP9l20fScD1AC
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 353040.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3448	msedge.exe
3448	msedge.exe
4252	msedge.exe
4252	msedge.exe
212	identity_helper.exe
212	identity_helper.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe
2332	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3968 wrote to memory of 4252	3968	00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe	91
PID 3968 wrote to memory of 4252	3968	00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe	91
PID 4252 wrote to memory of 4680	4252	msedge.exe	92
PID 4252 wrote to memory of 4680	4252	msedge.exe	92
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3400	4252	msedge.exe	93
PID 4252 wrote to memory of 3448	4252	msedge.exe	94
PID 4252 wrote to memory of 3448	4252	msedge.exe	94
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95
PID 4252 wrote to memory of 2952	4252	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe
"C:\Users\Admin\AppData\Local\Temp\00bf085cdab5aad50999ea9ece26badbb8c079cb9e3cd3b5a4d08f94fdbaa6b1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd5bc746f8,0x7ffd5bc74708,0x7ffd5bc74718
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
    3⤵
    PID:3400
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:2952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
    3⤵
    PID:2800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:1588
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5020 /prefetch:8
    3⤵
    PID:3436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
    3⤵
    PID:1236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5760 /prefetch:8
    3⤵
    PID:2928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    PID:4324
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
    3⤵
    PID:1940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
    3⤵
    PID:4872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
    3⤵
    PID:5076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,12073510448983397847,6913257387272360658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4780 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 2b08cd637d02ccbcfed5c2cb396aa347d88ac09dbc5733f513f715f200cfabdb
MD5 f34b4f500e705db5787d164fe4529333
SHA1 42bfdc5d16a6ae39d11db431053b6a23672c7b82
SHA512 36cdc660879a103deaaf473fb7013372f665682ae0df88b37599fb94c1f86262681c29c57be7085279637c505e161bb156a405fcd266a915052b4db3fb67573a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1002B
SHA256 9913a4cc7b47247baf3c677153971d6e2b59d40a0887a570e4b4ee3d583024c4
MD5 91ff0f42739d322233fa3f237d7b7e59
SHA1 72ba1d3912374a3470874cd737f4cd1a644d4c35
SHA512 cfe22511ad0ae58a35810aa2e5a288e7a7e9f9077a12446b373c1de03610f457e4c7c1a739957eccf5aee631e92e7bee848144c2033be30f3442c00c4bd7b11f
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0f80dc7cfa89c82f095b0cb1a0fd12d91007139d1be28def01439e24d433e66e
MD5 663adc00a10fcca529a3938ae659fe06
SHA1 f9bea8d22c878d0f0d54e5b18b1905c1464da62a
SHA512 d7c59b7916eaf91895dad14e8f2cb323927748173054311dfee7509e974e0ad4c77caf644c5aefcf0f8fbac91f45fd2a95b15dc8f90ddf2723d850116f5e95a7
SSDEEP 96:nBkiq1zfn2wpvWMoiVmdeHk4ajUWQyV+VDCziEwb:nBkhlfn2GWMXgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6fb8947582756ef270696053d5c707fa3573dbeae0a4580c7afc86ed1bb74034
MD5 e8a1f346f8159d935fa464113113f61b
SHA1 e143c68b24a45581136a6b2b0cc285e3657a6fc4
SHA512 4b06ca414e2a486a371bcd78d619261b6394d0f763b32250231f8bbf91fca62e95dadf15fa1e89ae0fbfd9a8f9f518de6746d1b662ef4ed32dc85e668b14ad27
SSDEEP 96:nBk8sQvq1zfn2wpvWMoiVmdezLlu21jkuWajUWQyV+VD7AiEwb:nBkjlfn2GWMvlu2hn1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 f2781e82a719f475c3010591964a3c09d8fe5cdc555dc3c7366195f7dbfc4c45
MD5 110bb926fe7caa329cd3d155d390d9b8
SHA1 0f571a85cb49650e6961e42f2c6fb59b916f782d
SHA512 c6a53965507298fab2276b6494ebd318b4c7d234e8f2aae75f5ca0b5c81d5b2b749c51de8391fa040d36de7188386b0d9ee5db4e2db3b53c50255aa6ab222ee2
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 8689673fe7301266bfe069be0de9b3598c6b7be27629a661f3fafb09b8e587b5
MD5 555212df495d3fe253066107c6f696c0
SHA1 3e3070092da33ab789d2a6cb882c906bffadc75d
SHA512 d1e90d0849c0a6536f4842df199a507c28edcaf914b3a7ef4ac6edccc26808c2a5de4f916640026453c3a3bbf361813ee652285b89372e826d13c93ec6e3f5c8
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58abac.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58abac.TMP
Size 537B
SHA256 3f7cec26f0fb966432fb81fc78ca79436b601964e536af0a97eacef863487a1c
MD5 55036fec5ae4f1d64ed92b95067b82ab
SHA1 9422d72eca256d8d4f953ce1b46c808b8781d3ac
SHA512 88354663d88dcd4568cfdd3f211e4c43a5f32c1dd0dbc3f72f47d17a1f2e6cea4d492eaaffa8ace0bf0566a205563dc0f1bddd03e5f4a1d6f1645b035581e3c6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 098fb249d6ebe18107126240a114bd33c52c8ac6bb74e8dcba9858502cde9eb0
MD5 3498ac6f75f3bda76602de24eeac4e00
SHA1 2376b760f071d747b88eb4d63dadbd6f64fb99ee
SHA512 8fcba9ab6a39fb3157705be56e82bc1819d13cc4ec0a520b52ffb51da0dc1f6851d8d9da892f42cf8daabb4c5347892015a2134e79c4d9d4d055f84c492fe143
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupegbe2RUVky4VC3z2OMDCRC:A9iIxuERzA83h09RZxYeqU6CaOMWRHqV
MD5 SHA1 SHA512 SSDEEP

Submit Download