569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 02:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1.exe
Size 164KB
Sample240526-cn75ksbb91
SHA256 569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1
MD5 944df6d1e87ef6ec2e377cef01c718ce
SHA1 5b75445da7032b5a40f2410bd1a0ee5be84af62c
SHA512 ac91683a697d0ad73f7133a7baaf778ab426b3ff1498e7f16e638380be40e0e04d54256a06ed83ea4754d25456d82029ce2b2c4cc8474bb12682a6a8f9537d6d
SSDEEP 3072:AzzgTraQs62o1xGqhUkNc/VSgTq6VCLIXMYkMlXSv:Ag37sQ1xGqhUd3bVvXEMl
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1208	msedge.exe
1208	msedge.exe
4432	msedge.exe
4432	msedge.exe
1640	identity_helper.exe
1640	identity_helper.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe
3940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2476 wrote to memory of 4432	2476	569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1.exe	92
PID 2476 wrote to memory of 4432	2476	569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1.exe	92
PID 4432 wrote to memory of 3776	4432	msedge.exe	93
PID 4432 wrote to memory of 3776	4432	msedge.exe	93
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 4640	4432	msedge.exe	94
PID 4432 wrote to memory of 1208	4432	msedge.exe	95
PID 4432 wrote to memory of 1208	4432	msedge.exe	95
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96
PID 4432 wrote to memory of 3056	4432	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1.exe
"C:\Users\Admin\AppData\Local\Temp\569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4432
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa852046f8,0x7ffa85204708,0x7ffa85204718
    3⤵
    PID:3776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
    3⤵
    PID:4640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
    3⤵
    PID:3056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
    3⤵
    PID:4036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
    3⤵
    PID:1728
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4740 /prefetch:1
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:4048
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1640
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:4228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
    3⤵
    PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:2236
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
    3⤵
    PID:1600
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,13506586199415209610,6998966413958069102,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5560 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=569e5b5496b88972bdcb92443b7f032f66814ad3e10f3e90613d3b850ef86ce1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3492
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa852046f8,0x7ffa85204708,0x7ffa85204718
    3⤵
    PID:2380

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c
MD5 4b4f91fa1b362ba5341ecb2836438dea
SHA1 9561f5aabed742404d455da735259a2c6781fa07
SHA512 fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b
MD5 eaa3db555ab5bc0cb364826204aad3f0
SHA1 a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca
SHA512 e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 008b775404ec550e6bc27727b09d6fe12502ba2801635abc7ae7735c1d3b2983
MD5 934f6fc9a440ef26537c0ecb54552812
SHA1 bd7b475e6ad92fa04f87512815d03ffc438aea0f
SHA512 5ebc36b3ef7d4607c95405cce6c6f2f95c464e307887163ddd21e149d59494a9f6e09c09284c537b50ec387be8406126a5eaf8e97a4ff2eca8f7f05710a7d182
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 85cd38494503931a3eb1e136eaf83f7d58488c99c9d685d476ade29c224b44af
MD5 e4868db5c4edd126760a78881a76bfad
SHA1 a8826124f153afb95977f838dcd4f3f9e9770053
SHA512 0b69ed94b467c0a0666629fb583e7d2baedd508356d2590a50b0794ef87afe21cb71fcdd9186b6805d63b173ed425ebac46e5aafe1fe3b31d885124b836760e7
SSDEEP 96:nRRkih6d1tlYroj0wpvWMoiVmdeHmQISUWQyV+VDCziEwb:nRRk+6djCoj0GWMXJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a8762b6c7d1d189bc8c240f20e00d800e4336fb252631c3dbfdb4b44d4174b33
MD5 0727ae7b1c8b5f3ecb4baa23c7d26010
SHA1 61d87ada24dfbe02f481556d457846bdcb0c4886
SHA512 4e5ded960960199d7a7bfdb6f2d45fc72ad0b8dbf42af01cee6319f935e0577c237d621c99076334edcdebe2eb50a144b7be0a3bb3dd274b6bffaaf6fcbc0588
SSDEEP 96:nRRk5h6d1tlYXnj0wpvWMoiVmde1RqYbZMkdf8qptQ8nFJUWQyV+VD7AiEwb:nRRkP6djCnj0GWMDqYbZBEqJfrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0df2190a860347a383e80d8fb03809981012127a846acc7660346a3e27083ed1
MD5 3d2a221ec5c0287074f05779b419214b
SHA1 efdc48a5be23ffeeddcd2d7d14afb7450fd51230
SHA512 137ca0493d130396a203f38e884d941251011cbce5d0bba25a3f3d9690039c5a4487e3f11ccb2514c4126487b64a04ef37fb895c22cd4d95416344c26fda0b20
SSDEEP 96:nRRk5h6d1tlYrYj0wpvWMoiVmde14u11jmQYSUWQyV+VD7AiEwb:nRRkP6djCYj0GWMeu1h5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe57e6f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e6f5.TMP
Size 369B
SHA256 d211234656e89f34dbcbb7d630e1ed2342e7d7a03f6a0c7dab6abd7928c25c49
MD5 cc8dea67913ae5b1016649aa552700fd
SHA1 2efc0c9014379f4d773f993aa000e3edb2738b9f
SHA512 7d82cec8df3b661fe33d2f65550df0034c7626beb2335acaf84b5f91f53f1e92113aa4b8a15742b0473c87663289dc352df241d22de8d6b559b92c68fffd7868
MD5 SHA1 SHA512

Submit Download

ad31fcb9-1edf-4a54-8ff9-2d6068cd4c71.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ad31fcb9-1edf-4a54-8ff9-2d6068cd4c71.tmp
Size 371B
SHA256 9198909966c1709495a8041494a71b7d23767e6a77be91b423197eb0acd9b2d8
MD5 74a7cbf4bde9f22b10a27151a7028b29
SHA1 d40263f7942dbfdd43803c162078ae0d408d3f23
SHA512 b7f7afc6b3c9c17f854a9b6ff0ada6fb04307a10ca178cf6b61d0fa50cdf8f7dae75fb2b3a0389681704dc0b6dfc68199f258f9c2710f37779c8f357163c888a
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 03b146675cbbd4a9997262edfd06fe8ead6ee4727aaf2539c116e91e2d64c5d2
MD5 371cd3e816ccc965a7019acb95a4b331
SHA1 c44adba77c8509b3c4e718cb071f2732251d6aa8
SHA512 1a0e158533ae023548c5367de6b02c0ef4f804e9301fc198cad123afeb61383e3aa8e26951e6e0a4cee90667eb3ef15c615d8a55fcf416b3c9bbd895cb9ace3e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupO1e2RUjBIKbSfYOxhZHnqm:A9iIxuERzA83h09RZxYOxkfUxTHqTMTL
MD5 SHA1 SHA512 SSDEEP

Submit Download