2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66.exe
Size 164KB
Sample240526-cn119sbb81
SHA256 2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66
MD5 2fc1f25d19b350f6e92d2cd71a70a2b1
SHA1 f67c5ebb90d3141a9643fef879d6bf5de1a88d38
SHA512 fecff4c84498d83d3e8e10650eeecc9874059e90ddefb79564efe8a07215d9a27da5ebdb39aba121a90d18d4e152bdd770b439f4cdac029dd64e3b44f60f06a8
SSDEEP 3072:TRBvFCwJDiE3tpO3u1e5G3ecWaOlm0IHDJQa+jh7Zf23LkEfqtKbVNXfCr3O:TRBvFuatpOMEPraOI0IF6jhVf23ZCty4
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2032	msedge.exe
2032	msedge.exe
1056	msedge.exe
1056	msedge.exe
4460	identity_helper.exe
4460	identity_helper.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe
4520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe
1056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3112 wrote to memory of 1056	3112	2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66.exe	95
PID 3112 wrote to memory of 1056	3112	2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66.exe	95
PID 1056 wrote to memory of 1000	1056	msedge.exe	96
PID 1056 wrote to memory of 1000	1056	msedge.exe	96
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 1240	1056	msedge.exe	97
PID 1056 wrote to memory of 2032	1056	msedge.exe	98
PID 1056 wrote to memory of 2032	1056	msedge.exe	98
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99
PID 1056 wrote to memory of 3380	1056	msedge.exe	99

C:\Users\Admin\AppData\Local\Temp\2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66.exe
"C:\Users\Admin\AppData\Local\Temp\2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffe313846f8,0x7ffe31384708,0x7ffe31384718
    3⤵
    PID:1000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
    3⤵
    PID:1240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:4992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:1628
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 /prefetch:8
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3332 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
    3⤵
    PID:1960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
    3⤵
    PID:4676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:4704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
    3⤵
    PID:4536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,12396919213701792958,14737630169334280556,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3052 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2dfb5032a58cf82cb066eee3ec5a68fb1bcbb06e1c98301ca42e719ea18a5d66.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe313846f8,0x7ffe31384708,0x7ffe31384718
    3⤵
    PID:2684

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 762be999b901b30227970f1f1a9f6403ff9f74e70948f28289dfeae5a1227904
MD5 08ff1a6d4a13595ceef23fbb6960f2b9
SHA1 b9c8150688e32a9ff5a7a097789eb1c7e64cb974
SHA512 4c6eeb9be87fdfcc512d3964c8361585d62e63889e0066578ea75a47d73025cf068e0b1986921bb0dc27f1754c52dd95d35835279bb7a509f8be19ee1b06ce26
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 577799a97bc554bf5c305cd755185e1852cae6642c64f4454f20a3c57329a6db
MD5 d973d34fd5ab4d6ebe5f859be438fa97
SHA1 f1d6492cd6ae381adb6b69bfaaef1e701ee8184e
SHA512 592feb776e791836e90050a497b8c87b4f1bf2428f605bea410fe3e12bd256bfa917e86053ccb6f9da35c53b001d4150342fe9e7b19b7b21bcbbd0e0e834d6aa
SSDEEP 96:nv/k5G12QwpvWMoiVmde1uYQMkdfVp6r/79qaUWQyV+VD7AiEwb:nv/kIcQGWMoYQB9e9qarg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 096ec5ad5102144223982f81234c2c1575d5bf858471f9398c55fde1c7fbe55e
MD5 0aa556420b4e5a09c8fd27c96df7f435
SHA1 85efe0dcba9f6afc24a4e09daa3d1448dd3484aa
SHA512 ba1df52d0c57a63887ee1d1238a5f6555e2e1f42580be3b94529887d24610f1053189373bb1f577f6d99b35cd1489b7c235e26c12c3b32268606a852a26110a2
SSDEEP 96:nv/kiG1O1wpvWMoiVmdeHBrz79qkUWQyV+VDCziEwb:nv/kF41GWMXB9qkro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c23aecd5cd15e92a9657b96659e58e4d2e4aab0574e21e3d4fa95b668f0bde4f
MD5 7083ba21e68f599bd6973dddcf07179a
SHA1 81b3885efa6daaf841a6f046067ac51c23b62150
SHA512 47972e412d66a76ef9bbc20d647dff1cf727df550b94a0c79364add9482169e1c0bb82de75d741358a544409ac794acf1fdcfa7546564c10a50a326007e3d7ec
SSDEEP 96:nv/k5G1OFwpvWMoiVmde1Jup1jBrM79qkUWQyV+VD7AiEwb:nv/kI4FGWMnuphU9qkrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 56be184e2a7cf443c41b635f5ab64ebbd4aef78dafd3c40866b414a2557646fd
MD5 dabf2bbf7866080a8d343c560a6f92b7
SHA1 4f6345c2457deb1f08cde6133a352e2a2fae16c2
SHA512 4d5921ec10c4a5ae2530f684974597ca4273434c91d69c6211cca544dd19810ea717c5838ab157fa15785a4a39737b49e0c7ead8871630badffcb570e9b5f3b2
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b6cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b6cd.TMP
Size 371B
SHA256 38601affe539e3341574ab148d511b364d4fe98efa1d15b532ca5c9b9a3db5cd
MD5 c345430a9b8cf7238808ae1d1f4af25c
SHA1 e07844df6e97a113d0ea48f1468309c607522738
SHA512 0bac8192311084e823186ab83344ad790050ae555fc1e9943aceb7930bb6cf7169b71fa513f94a5fad9130db918d1e40f270265e64a92c56c6e02a2fff58248c
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2ef1ecaae84bcf47842b3004c6479208429d087bf1de38255e8c3753fe9b82d1
MD5 71f801ef2a671b26b00794ac204301a3
SHA1 e005ef2e9172626e208c2ef8b015a7c1fbf52ec1
SHA512 6fcacf391b3ff83e6a5ed3addff4099e81220ddfe891482876f4317e54072e279174d3651220f8dd19692997f6648fd57a5b28106e5a84d1125426e72d82b139
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgH5e2RUYAMj2Y3z2OMDCRf:A9iIxuERzA83h09RZxYgHtbyYaOMWRH/
MD5 SHA1 SHA512 SSDEEP

Submit Download