6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1.exe
Size 164KB
Sample240526-bwc4qsae99
SHA256 6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1
MD5 8442e1857102fa7ab176e7ef89e1fd01
SHA1 a3014c8f1520bb3f837535eaa6c978ccdb327864
SHA512 b9e02dce036794148bedea6af0672d572a7ddd526d916434e108c2fef4bdbf8aa349c875db410e2b95a69054ccce8472fd899fe5ba18034692dd0725b4f26a15
SSDEEP 3072:/ml/kYu/J1EpBnudMkK8sU0yyzcRC4hmMqbL1vy8O:W8EpBujKC0w0j1K8
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4456	msedge.exe
4456	msedge.exe
4036	msedge.exe
4036	msedge.exe
4512	identity_helper.exe
4512	identity_helper.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe
224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4036	212	6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1.exe	92
PID 212 wrote to memory of 4036	212	6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1.exe	92
PID 4036 wrote to memory of 2776	4036	msedge.exe	93
PID 4036 wrote to memory of 2776	4036	msedge.exe	93
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 2324	4036	msedge.exe	94
PID 4036 wrote to memory of 4456	4036	msedge.exe	95
PID 4036 wrote to memory of 4456	4036	msedge.exe	95
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96
PID 4036 wrote to memory of 4232	4036	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1.exe
"C:\Users\Admin\AppData\Local\Temp\6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3eb646f8,0x7ffd3eb64708,0x7ffd3eb64718
    3⤵
    PID:2776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
    3⤵
    PID:2324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2408 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
    3⤵
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
    3⤵
    PID:2520
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:2548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
    3⤵
    PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
    3⤵
    PID:940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
    3⤵
    PID:2376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,281725653887224469,3453540059494840733,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5548 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6bb9bf84410f721accbe54fdb9e89aba173379508f592f20d7ccdc68661388d1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3eb646f8,0x7ffd3eb64708,0x7ffd3eb64718
    3⤵
    PID:1972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 68777c7f0b1a874ffdeecc0311f28f2a48e438fa5c958277126c753584ec8a44
MD5 d52f5f39cd7eb6c03cd2c1171ac06ec9
SHA1 d8a3d9da638e6c9c0b7a5dc0d1c05bc30e7e902d
SHA512 1501887ce2392f1a2abc0c6b56f7bc3cafa08bbad565a972a40344451c58ca102936ab5961cf2d17a1cf885ca841df28a9c2654112ef66cca34b265084a171de
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d57b37a592929df61ca18daa1023b790e234c7a42f065c229e48dd22c7c6f753
MD5 4ca3252ba924baad812489a7f3ea6a59
SHA1 81a57b86051a28e38073173334813b239efdd026
SHA512 8f087446ad10df18d4992c9de911a386f4636b55022ff493f4bd072b8eaf4626882b81bf24644ad8a4b3b86b062b4c6d33e5ae26c13260a1fc5dc99ff037a89e
SSDEEP 96:nSkEe1uJaxj0wpvWMoiVmdeHmQIlUWQyV+VDCziEwb:nSkXcJaxj0GWMXiro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b4d098483fd7c9ed5c6b9f34fd776e7ad24303146b5f2c23ea0c6cf28a02b373
MD5 308392ef4034d311e956d389d26ddca6
SHA1 0ae9011a68be7ce97c9afa9fe1bab9879ba15fd3
SHA512 444020a4c165fdaf1bea1d8bc4c5e088f86d0c8c99eeb00437f1284fc918922173092b5d9e1f03deffc4b435d0759d3cb1055f8307bf52d76c73dfe7c1363f55
SSDEEP 96:nSkze1WJaMj0wpvWMoiVmde1pYbMkdf+ptQhrUWQyV+VD7AiEwb:nSkCIJaMj0GWMrYbB2Mrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f83ca73d10c5a204e76973e7646607cee8bc7ee75cb5161d0dd0ef7d7234db68
MD5 1e0dc52f2478667e94c81c91df518265
SHA1 c9e6aed7873b0be471643be9aef0e603e95fb1e4
SHA512 e3a4b3929c8fc52ecfb90abf4feb718a4a7a7e689ab8d0f2ee3f2a07300f6fa0fd0aefe5c73fa1e643ad0184ed8a518aec7c0bae062f388789fb5db406b8a278
SSDEEP 96:nSkze1uJarj0wpvWMoiVmde10uY1jmQolUWQyV+VD7AiEwb:nSkCcJarj0GWMyuYhqrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe57c052.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c052.TMP
Size 371B
SHA256 3df695f45aa2eeaf0487abdbaedfe147e48cf972917f2d2b48e37f39c3860de1
MD5 f6eed5b439d4f3359c82ae1707dfd915
SHA1 5581a037ec04eca12659e8af57ee807d88b763f9
SHA512 41967d5ae0335ea9bcdb9041a989165259486a6afa972699dbfb289c6d064c96af1682be0a0a3e927475f73dd222468bacd5f70a9f1ab20616b474a2b596ec67
MD5 SHA1 SHA512

Submit Download

a7dbac08-23ef-4a07-8ccb-af17cb1678ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a7dbac08-23ef-4a07-8ccb-af17cb1678ab.tmp
Size 371B
SHA256 ec863d8e874cb4f7bd0baaa124c7b00e3d5efd538ec27331c38dc944ca491aeb
MD5 a14b9510520b9e0c2dbe7762439ee2a5
SHA1 adfff5ee319023b96865c04dc32a81aba2191e15
SHA512 20992e30d492b3b884c0dbd9946a1193300f023239a6b911961f0b405fb2e95dc6bca56aaa4c32d566866ebf340df6df751791440a0e3cea2b73d27f0c8d45e4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 ce2ea43e11b7af0fcb6c2b5279c6a28da3837703414b63dc89f996a3e9b4774c
MD5 58e169c286135bb788c5ff639341e290
SHA1 185e40bea5239a9da3ddef84db028c8c1be92077
SHA512 371bc1d86413ca86db4a949986717a854028302501f351f370d3ee5936e6db0beb65b76d525edc2d640d90194a7a28e5c6fb69b539243bf90528c8aa4459b490
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3Le2RU9/IKbyHfYOxhZHnl:A9iIxuERzA83h09RZxY3bYdy3xTHqTM1
MD5 SHA1 SHA512 SSDEEP

Submit Download