a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86

Analysis

max time kernel
139s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 01:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86.exe
Size 164KB
Sample240526-cdvrhabe35
SHA256 a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86
MD5 7e71edcbafeb120d5722222a95ca4aca
SHA1 81f2efe43891aeee85f63306dd7d80f42d0f3249
SHA512 df7f5fbc4cc19c6347cf97aa79048ce2960f293723fbcf7f019a101f15405f9b91182d21966d207babf622913f0841b375434cf547593526bfc5415c30316f3c
SSDEEP 3072:cASRvrsWTYXEXYUsYoJdc/UudZ63QF4l7kqlyA:QvYpXEoVUUudZSQF3wy
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4620	msedge.exe
4620	msedge.exe
1644	identity_helper.exe
1644	identity_helper.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe
1936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe
4620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 212 wrote to memory of 4620	212	a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86.exe	94
PID 212 wrote to memory of 4620	212	a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86.exe	94
PID 4620 wrote to memory of 2872	4620	msedge.exe	95
PID 4620 wrote to memory of 2872	4620	msedge.exe	95
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4012	4620	msedge.exe	96
PID 4620 wrote to memory of 4632	4620	msedge.exe	97
PID 4620 wrote to memory of 4632	4620	msedge.exe	97
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98
PID 4620 wrote to memory of 1036	4620	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86.exe
"C:\Users\Admin\AppData\Local\Temp\a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xc8,0x108,0x7ffa3a9146f8,0x7ffa3a914708,0x7ffa3a914718
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
    3⤵
    PID:1036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:5092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
    3⤵
    PID:872
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    PID:3600
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5160 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:2780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
    3⤵
    PID:4344
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
    3⤵
    PID:1796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:4384
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,2009015907274210779,659952320608503990,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3668 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=a2bd2c730e1baff853d205c3f24f5952fa0c06f98288a0178131cc34bf1a1a86.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3a9146f8,0x7ffa3a914708,0x7ffa3a914718
    3⤵
    PID:4148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2760

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 278361c04d02acc228659b9aa4decb64540620add1758bd716a54aa847005e4a
MD5 d55db52801bde84eb199e10cabeb60c1
SHA1 65f2e5710960ebb99dd63b1df47dc137399dc308
SHA512 8bdddba53b40fa8a6d2e2ca60103781b968fd3c6bbcd31821dc73ecf4af78ae83bb78db88341bbdfe114c727c691c963eac1767cfcff48ac89f676e6c79d5e6e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c7c3d83783d26c8bcf143ec2f521041a76f4e31b4dd5997d596e2e11b55c0945
MD5 d8302bb92b5456d7af5071a63d75a549
SHA1 b46f8093e81cf82ff1edffccfa2d0c51b2e7683a
SHA512 be19bb16e6a118fa382f89362c784cd27dfd0d338ad25249c561b52638029a3b5defbba4de50d6aa8538caa82de2f6edd3c8af51dab2e129ae647b7a823082c2
SSDEEP 96:nQkJg1+wrjuwpvWMoiVmde16YyMkdfRpcSknGUWQyV+VD7AiEwb:nQkC/rjuGWMgYyBp6Grg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e622bd05529ad32747eba0e72cfd2c371e77be803e9f60402f3d7d6852f5cc5e
MD5 e89abc4868ee262120b2e6b16708a347
SHA1 89dbc4d44030915d34633e89301acac9990c2175
SHA512 57bb5eb66ab31f0abbcc16aeb74cd09c58eff64c493faa2be8507b68807a75004ad69f663324a18f2618bd3367ddd2ed437d736a39d892424fac49a4fa1e49af
SSDEEP 96:nQkyg1+U4juwpvWMoiVmdeHvSSn+UWQyV+VDCziEwb:nQkbj4juGWMXh+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a9669ea309572d577797cf3ad28a72bc25bc0aed001d0de8b34d61a6da80193c
MD5 19956d78365f4c32a0ac3cf787516e26
SHA1 5bed543d62209232b95503feda1dac9f7010c536
SHA512 6b1487475f431fa219e6a8540a792911048c932f0dca488ca5a1f0e132132378ba80564022ef8bf5c638fd1cbe82aaaa3597a98ae162e45bfe60034119cdc150
SSDEEP 96:nQkJg1+UojuwpvWMoiVmde1fun1jvSFn+UWQyV+VD7AiEwb:nQkCjojuGWMFunhm+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 711ae31b40110f4ac759f496c3ea06ee532cca7b2cd39b1d9df7ea5cec200503
MD5 bdecbb060ca8c4c7a013d219517478d2
SHA1 daa812c6caf4273374cc7dfd778d68971a8bef5b
SHA512 a2fc7cd42c4eaa099c36078a9e8c3b1a2e4635990885b251b5c5695a5a3a87c03c3a2054419a2226b7f5ccae9ae86375d0ea7db36ac97acc8b0af2c15875b8c9
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b9bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b9bb.TMP
Size 371B
SHA256 65efe892eb7419b9c1c7c077874bace89dd858ad02f691931b0e899b3450439a
MD5 fbb3e9cd499bfd8958f7ee03bb945d28
SHA1 3f7a77ba22e7644f25001e26d268b13274f47f7f
SHA512 7bc7a685e253652d76e8bd0a5753a5e971d86ea0476ff279766b1141d2cecd1dbc7f3b316ce7d5ffbd5798f25f2f029e2ad1a0630f04809c5f0ab3c9bddf5677
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 28f6c13c47176304431f1c7487914d74b9986c4cde7f8e4ac500026da6f2f397
MD5 3c6968d59dbd4e7a58387101bc37ba72
SHA1 1349bc4ba9b40e6dc902d237504eaaeeb0742706
SHA512 fd5a955537ecc03bd3f8f2552f5d366d1b649bd6e51b3c22b68089808b558340c360ba18ab651efa4284636eb62583be577221bee104f74f166d3f88836a0799
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphsR3Ie2RU7f4uq3z2OMDC/:A9iIxuERzA83h09RZxYhsR3mcrqaOMW/
MD5 SHA1 SHA512 SSDEEP

Submit Download