56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 02:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67.exe
Size 164KB
Sample240526-czleyscd68
SHA256 56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67
MD5 94f8417678b4b93aa1dfaaa65ed33e49
SHA1 5cbe6a6a2f1a7b19dfdb89b29c4a13f2d27ece18
SHA512 1dfccd5d9c9e23819cc45ad790c96a7fa5b74f79b9f38fb2eaa2cc0025ba6fc052f484eca32de63c03027eefc3b5e257c160f0c0bf8a2e77ac5f0ef8d8b68f58
SSDEEP 3072:VjqITvz4sJrGnSKGJl6lspdMtldlpDyBBnP0:VOgb4scnSKGJiTlcBB
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4748	msedge.exe
4748	msedge.exe
3256	msedge.exe
3256	msedge.exe
932	identity_helper.exe
932	identity_helper.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe
1960	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe
3256	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 3256	1112	56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67.exe	96
PID 1112 wrote to memory of 3256	1112	56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67.exe	96
PID 3256 wrote to memory of 1624	3256	msedge.exe	97
PID 3256 wrote to memory of 1624	3256	msedge.exe	97
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 3312	3256	msedge.exe	98
PID 3256 wrote to memory of 4748	3256	msedge.exe	99
PID 3256 wrote to memory of 4748	3256	msedge.exe	99
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100
PID 3256 wrote to memory of 5012	3256	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67.exe
"C:\Users\Admin\AppData\Local\Temp\56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xd8,0x110,0x7ffe96fd46f8,0x7ffe96fd4708,0x7ffe96fd4718
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
    3⤵
    PID:3312
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2612 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
    3⤵
    PID:5012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:404
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:4376
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:4940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:2412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:2300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,1178234973897684723,4621534173970423366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1808 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=56f04e34cd9eee4b3e94fd6be4e653f5cbc031527f67c5c77bf3a14dc35fbd67.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5036
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe96fd46f8,0x7ffe96fd4708,0x7ffe96fd4718
    3⤵
    PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 ebbb1ebdc684f3612ee429c6ab003e084d1f72f3b2ae5a765838f4e981c84f49
MD5 23d13db7ae409ea6677bdd5937c79fc8
SHA1 fefde065d2030139c6bc812546fd1602ca315caf
SHA512 60725b028f75faea3e0a88e5bd6c5b7e210255a018fe03acfdbd71e78f54928d85e27125b06bb401280e37b00365eaad197166bab5e477eda3b71710f19aa6f9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b52f55997e011104ddc3dab3c464519d7a63a2f573b435d4ec609d35d5d6472e
MD5 a3260b2b5d97f928357d89b1812ed88a
SHA1 48a71fc425087a28b43d427db5bd78ec3cc154c4
SHA512 4de0708c6ed3fedb4377e36d6ecfbcae814cae27adef922dbbbefcb87e50381ff62218ac7f3dc4aa28e599edd8ad5f66efe61a8ce930cd60b4a74e4ec8bf72a7
SSDEEP 96:nkkkoa1NBwpvWMoiVmdeHBrzZnOUWQyV+VDCziEwb:nkkfaHBGWMXPnOro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 641fe58e23f8dc4f1be8c01cad94cbcde118fd2e1f222123a0628df8bff8ea64
MD5 c33aa5300ebf3220afbb5896bccbf112
SHA1 a5932285261d5dc9406fcc4e794c4df267b62af3
SHA512 b83291ec605a01150fb223dabc117ca248f9659f525b08d5e19d9d946a547686b6ceb6ac5ba9da550fff579f536539ea690195c5400ac48d868a40579b744724
SSDEEP 96:nkkToa1FEwpvWMoiVmde1fYxMkdfZp6r2Zn7UWQyV+VD7AiEwb:nkkkaLEGWM9YxBBfn7rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 de0b19a3b0cf8b003b502dd0bdba50cab58b969f2beb402d8f65cbeacde28d6c
MD5 397855b7d4c245ac5be9227d4e759bc9
SHA1 e18d379dda94cbb9cf46dcc0b84ce4e38a26d0ef
SHA512 f110dc387e15808db7faafa98f1da9aee790961528d3672fbf2df8d8d32b5a6499ae7501428447c75ae97f88316105bd6de4ad2e51e885ef447cf6f86399b382
SSDEEP 96:nkkToa1NZwpvWMoiVmde1Guz1jBr3ZnOUWQyV+VD7AiEwb:nkkkaHZGWMwuzhPnOrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 d628f49216ce3daa874e7e5a5eb57ab584fdc90dc0fb756b5a49d0d7bea5a1e2
MD5 20ff6091074f144b2de4acecc9937eef
SHA1 987082dda61a3b5e8762141c9519f67639c262d7
SHA512 0141706de50be6cbb4cdfee42f96efd5bf7c0228b68bf24a8ce1c93e155f9846600a0771eb8dff660b2e7355d9a8624abee2da5ce628ffd9f8cf876ba411c767
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ca64.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca64.TMP
Size 369B
SHA256 0219d1476ff0704e540782131942d03c4b01afdff81dc4514cad941306a74d70
MD5 a8f44cad262eef6376ed6dd60207f012
SHA1 057bb19991f93367a1a185b5c3013cbd8198d8c3
SHA512 521ad7e848d94a1cf0329d6c2f39694028cb36d46da0ed69bff7197303b3d0889c9bd65645555238342050b0c998354511af1aae095afabad62f57f6a3addb74
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0696fc77afa3484fdc13fe9540392411d7d5e7db1f94288193ff57d7fe699e22
MD5 a7615a7a1eba13e3a387e7be3a548e05
SHA1 b9fa9c11cc0ae1a1cd681be58bb616ab34a1b023
SHA512 48f1ed9b3ab4e8df05c3d68e4c0265d0709baf52d7b0d5789c3a226ad437b437825b196839aaf1945b992d0aea26c59ccdd0d73163858060c476109ef96ece76
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupjUHhe2RU5oMj2S3z2OMDCG:A9iIxuERzA83h09RZxY4H14ySaOMWRHY
MD5 SHA1 SHA512 SSDEEP

Submit Download