d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 02:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1.exe
Size 168KB
Sample240526-cw9ndacc69
SHA256 d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1
MD5 37af58aacbfc995f97757f7e1ebb5961
SHA1 a4aace6273494565ac0a7964c05eaf6b5d36ee44
SHA512 a8199851c9e2f1285db9f26b49ce9da25ac49062dd0d760a3f185db8936f68e190bb4907c54c88d252cb0f4e658bc7f4e1a43412ed9c57e8c1407954f8ca99a5
SSDEEP 3072:6oqhpsU+k3vBaM8IeRdM/f0EBTvNyxfYIleHWzID:6oWXaMRgMFTvNy3lwuI
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
548	msedge.exe
548	msedge.exe
1484	msedge.exe
1484	msedge.exe
2212	identity_helper.exe
2212	identity_helper.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe
228	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe
1484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3260 wrote to memory of 1484	3260	d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1.exe	93
PID 3260 wrote to memory of 1484	3260	d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1.exe	93
PID 1484 wrote to memory of 1856	1484	msedge.exe	94
PID 1484 wrote to memory of 1856	1484	msedge.exe	94
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 1204	1484	msedge.exe	95
PID 1484 wrote to memory of 548	1484	msedge.exe	96
PID 1484 wrote to memory of 548	1484	msedge.exe	96
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98
PID 1484 wrote to memory of 3748	1484	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1.exe
"C:\Users\Admin\AppData\Local\Temp\d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8f9146f8,0x7ffd8f914708,0x7ffd8f914718
    3⤵
    PID:1856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:1204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
    3⤵
    PID:3748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
    3⤵
    PID:5000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
    3⤵
    PID:1256
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5268 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:1880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:1192
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:1200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,16706678698243560736,1808150098921362502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1844 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d3fc0c86f11ec6933ec18470bef8cd65a22f750bd278a0c7aff34af1d63e9cc1.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd8f9146f8,0x7ffd8f914708,0x7ffd8f914718
    3⤵
    PID:4580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 c1f7c257a0c7578560230a5d996e757d2241aad3fc2a4a2bb1a7cb5eb8fe5fb8
MD5 42f2f88ae77fdbf6ae88488a4d81f817
SHA1 c03264dc24517bad4759f4dd2cb44aa8a5420fb3
SHA512 7599e83f25a1e52354bb04fae932d41147c8174e11c5eb4bdee50cb544bc9a00993b2044448b7c93277b14d03c9ede01b8a64498ceab509b8d4a4b2be33896fa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4f47dfcd95858661eb326e4dc87a900d1da9eb597a53473477490366dcc4cee3
MD5 dc0dfc91ec120ab0558ffd416d1214e3
SHA1 ce6ae9eae9dd7c4d5810f71f7f8b2ed7db385605
SHA512 a33d649ebec7dc4714107fed6865296ab6e7814d078edcaaf283afb885b529035d16993fbb227176855687f635924bf67f89540a98ab2c1d914e138074d95815
SSDEEP 96:nykRp21ixwpvWMoiVmdeHm0+UWQyV+VDCziEwb:nyk2AxGWMXiro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6d8b066a3cc5ec8f01bdd6d68188078bbd61d454e73546363a544333b86d0c52
MD5 f23b675a7f171b3f98db857b14cf5986
SHA1 692ee625f5d812d991a8163957781bc3079fee0b
SHA512 dfa6094fe3f80c77bc68d16be508b2ca83e9f2d325e6e043135c3d07f7d742fda8152dcb15a794014614a660369e084050feabe72309b84d6d6e2fd1efac6636
SSDEEP 96:nyk0p21icwpvWMoiVmde19YYDMkdf+Ypla3QUWQyV+VD7AiEwb:nykl0cGWM/YYDB2YSgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1dd802df26f7e8fea5256360a5879ba7489bcdd342957b0ae0da2815ecc11669
MD5 3cb478b738377faea53b8639d087b281
SHA1 6176235cc574b9c82b72109897e9d89723494a17
SHA512 e63d975c27ca6400a87cdbc7ce473463f6fbeff215853cd30dbadaba744e319be1072a1ba61af5187523e3e66800be71df8718c4b1e2a5a3cb848ef01ba52f09
SSDEEP 96:nyk0p21ihwpvWMoiVmde10u5I1jms+UWQyV+VD7AiEwb:nyklAhGWMeu5IhIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 71245fa9accd3184401bde34f9691920076bf610b6a4cda2ea1e656b7d4de0c5
MD5 0abf1499c8dde374563568f32cf6556c
SHA1 fe5488abe727e1673375debd66d5166561831d74
SHA512 4f25e34c0058989886fb183398755c3b8ab2c7fa422e0ed3b015b30ac50412bbd09f07bfb3c35d2a0586243fe0fc1ae681621383ddbedbc4dd72cd3dc963f2b6
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ba76.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ba76.TMP
Size 371B
SHA256 1498edf2889e1193793ad65df653bf1ece86371f401ff9b34ca792032636d0bb
MD5 cecf874b17b1fdd6571f7074e3c83862
SHA1 efc179716ff383b86f7debce6f270b2c9830a1a3
SHA512 b6452818b4e9ba9ba42618978cb687dc0bfbf26e54d732862d513741f0389d63f92f13d5f236ce1ccfea7043eab5f591ef26021a973b80efb4ba5e1412255706
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 464354e597075c28009c2ee3d4ae21bc93716b6f0ce30f3b88c1ba81394db2ad
MD5 a086330a4a87de91c3646434b0ac1b1b
SHA1 e4b432b98c29710c762dd74122298f45d36e2824
SHA512 aa0bcd013f68b6fb0e6aaaf0ad454088e7620ef86fd054e6001700bc4fbc6a3e59ceda9891ae349eb2ed16468a313e6768774575eebd4bfd43dc318ce6c07687
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuprI7e2RUUezDL3z2OMDCRH2:A9iIxuERzA83h09RZxY2WDLaOMWRHql7
MD5 SHA1 SHA512 SSDEEP

Submit Download