6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf.exe
Size 171KB
Sample240526-bv2eyaae75
SHA256 6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf
MD5 4858e8a6f57f638cb247f620ca83dc23
SHA1 8af248eea18e0c34fe12b2c695ad2794f188dc30
SHA512 34bbd6743226ea33569494ee100001a502f84b12de2626a41786c06cb535ea0217bdbe8d208e0f002fc9d3ff7c8743fd0e4bf41e8ae044ee893bd4f4f1e94092
SSDEEP 3072:SVXGoU7/AJZugiiSM8EwN8pMxQtsOxMRQ+rsrHh00kFgWV/w2KU:SV6/0ZugDwNrQt+RQRB00kFgWVI2
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2296	msedge.exe
2296	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
1968	identity_helper.exe
1968	identity_helper.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe
2388	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2388	2004	6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf.exe	94
PID 2004 wrote to memory of 2388	2004	6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf.exe	94
PID 2388 wrote to memory of 2352	2388	msedge.exe	95
PID 2388 wrote to memory of 2352	2388	msedge.exe	95
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 1908	2388	msedge.exe	96
PID 2388 wrote to memory of 2296	2388	msedge.exe	97
PID 2388 wrote to memory of 2296	2388	msedge.exe	97
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98
PID 2388 wrote to memory of 4328	2388	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf.exe
"C:\Users\Admin\AppData\Local\Temp\6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec54046f8,0x7ffec5404708,0x7ffec5404718
    3⤵
    PID:2352
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2464 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
    3⤵
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
    3⤵
    PID:2384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
    3⤵
    PID:1152
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    PID:2484
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
    3⤵
    PID:392
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
    3⤵
    PID:3612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
    3⤵
    PID:2860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:2544
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
    3⤵
    PID:1616
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,13616412387914910936,2989023193718537233,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6631dcbb5171060414a456c92403f6cda279554c14ad76f97d2bccf245f0ddbf.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffec54046f8,0x7ffec5404708,0x7ffec5404718
    3⤵
    PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 bb6ef17260cfba44a6ff6f0e565c8f08954414c00c6dcbec8eaddafac19c3b38
MD5 4c6413491114654c06b103616b17a9a8
SHA1 5f3dfa4a1762bd2b8ba26a398913945e8474a3a2
SHA512 446beb4bd45e45513831b1bb3362948c5b10f98c4333835776868b9b2d64724ddd755ab168f9ae31df0922975ff36f58b9af9b60b821107f5fd0b6d7f5e77554
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8c36ea8bc6950d386d30eb3e7e78836f9de15af67c9963481340756f95501ea9
MD5 0e89ca0a8871e2f8f14184674e9ead84
SHA1 2840f1236bfaacf62f31a798504a95e0f3ff9ea7
SHA512 cda3e0806b9e60d66f3f303729f3ce712b8ab29855ae0540bbf289d5a5d2dd58487308b24e73f7e02ed7ca72a173c5e4a8509ce610b5202332170f8c200e757b
SSDEEP 96:nXkch1muga9IQwpvWMoiVmde19uu1jpCMAbR+UWQyV+VD7AiEwb:nXkMw9aCQGWM/uuhpmbR+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 91fd5fd193b745faf3ed7d0307806ee1ccb1de0785723e5aee9026b65ac298b4
MD5 6cc2a03bb45f10b13386b3fdb8d4cf6e
SHA1 1b02ee73ea50789f3b5c8b1be6c55c70d503aa89
SHA512 f4e541f84bf070a1153f327a643d6e90807a8324af58ffe8038dbda68f18a0b11d441e4a037f98f84132c6115af5a055214eb2c36db8dd6e0729e1a32649cf37
SSDEEP 96:nXkch1+vga9IQwpvWMoiVmde1ZqY/YMkdfIqpyC3zRAbRDUWQyV+VD7AiEwb:nXkMEoaCQGWM6YQBTgSebRDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 60599d5c4c2534301634c5303fce3c2f300b67b7344d93e04c50240a3d115872
MD5 ba2c399c9a38a8032b246cd3e4d3fc2e
SHA1 9f23ea076263441bbbfb9f6cf0a91ba0b45edb1f
SHA512 b9f546bf794a64afa575041abaab4067234ed7000c9138b9bcdba44a6beb0fef0622fe30114d4bc9ef54e592dba933fc6ac248376a9db952fc4e23ce18163541
SSDEEP 96:nXk5h1mega9IQwpvWMoiVmdeHpCrAbR+UWQyV+VDCziEwb:nXkXwNaCQGWMXpPbR+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 9a7079989f8f169aa2a935bb07778e9087cebcd8a4b72de2b40cb48d9c1d8911
MD5 00bb96f49c28c927286e49e6cd60cd6a
SHA1 394a18e5b718de376c2a9e52a34fbe24cbd27763
SHA512 0ff82ada2e9f162164a94be6183da097d54e264c45dedfd6fb2949681dd87565cee2786949ae766b0aa641ca7b9f0863639cae5ecf22f7a0ff7459ab7d6af70d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b6ec.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b6ec.TMP
Size 371B
SHA256 4f47a04a57cf975c38f0c870d2b877d562b78070363b471e7e9fdf0f504ce3a9
MD5 7c390f8fbb214702bd4e5fd0a3112c44
SHA1 f7ef919ac26ac7856f012a07a77bd8e76fc38eae
SHA512 db51723673a6697949034f510356121b9ede086830fd1616bc330267810615aedeb4ba9baf4b3c6e8fad2ac1ab870960966fe2a44e22952f8b2a7ac14b1216f0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 46fbfcadf5f9a966b275a59a83ece8c36facd01fb7be59fa89b2f8d4d8759a47
MD5 6c0bb86dfdfeef47ae29db2c59756460
SHA1 b6e0cee9a9a1d0ac7361f263b2f88da01a3debb1
SHA512 3ddd005ccf76705065e947393405ceb44ff8f2b57c304ac56bcc07960f06fd4c6ee7ffdaf9a3e90956d59147bf2a448944243d500ae82c6c49f3b68abfa5f2d3
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCkme2RUljf7ZN3z2OMDCRz:A9iIxuERzA83h09RZxYCkoIzZNaOMWRz
MD5 SHA1 SHA512 SSDEEP

Submit Download