2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06

Analysis

max time kernel
138s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06.exe
Size 215KB
Sample240527-bmal9aba6s
SHA256 2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06
MD5 63887685de620285c0f90e507b61570d
SHA1 f1ec526bebf67480a4958e92a38a0d5eb3e2ee8f
SHA512 17d47f36c55aa965ff27dea70589f97987f827643b088c263b8034ba7b9d379c832add2a3bd087df21101800e0b723a1488b434354c1ee0748c1708e00513e29
SSDEEP 6144:mdsKl5UQFpO5jWZ4awaeJ9eZq8KbW8juDW:vi65jWZRebe
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe
2040	msedge.exe
2040	msedge.exe
3656	identity_helper.exe
3656	identity_helper.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe
1504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe
2040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2588 wrote to memory of 2040	2588	2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06.exe	89
PID 2588 wrote to memory of 2040	2588	2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06.exe	89
PID 2040 wrote to memory of 2756	2040	msedge.exe	90
PID 2040 wrote to memory of 2756	2040	msedge.exe	90
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 2808	2040	msedge.exe	91
PID 2040 wrote to memory of 4032	2040	msedge.exe	92
PID 2040 wrote to memory of 4032	2040	msedge.exe	92
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93
PID 2040 wrote to memory of 1996	2040	msedge.exe	93

C:\Users\Admin\AppData\Local\Temp\2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06.exe
"C:\Users\Admin\AppData\Local\Temp\2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1eb346f8,0x7ffb1eb34708,0x7ffb1eb34718
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
    3⤵
    PID:2808
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2292 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4032
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
    3⤵
    PID:1996
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:4568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
    3⤵
    PID:4440
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3656
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:4060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
    3⤵
    PID:2840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3628 /prefetch:1
    3⤵
    PID:3248
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
    3⤵
    PID:4388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2228,9419764313011386517,11624097981742311621,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=2685dc0068dca5d974f4b19bcd23d2eb256e3a893959ccf54a8eac4ce13bdf06.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb1eb346f8,0x7ffb1eb34708,0x7ffb1eb34718
    3⤵
    PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3356

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 afb88c3ecde9b1b60091dbd05e90b521bf5e29edfad28d1d4e134fd46e9d0dd9
MD5 b2e7ecdb14cc9404daa888e6c617fce9
SHA1 f47ae498cc77ce9b0e4eef0ba1a32f812091d87d
SHA512 a7fbc474533dd11c66a73cff50c4f91f0b32a4bca757fff85386b308f09751e672327f86e29793cd0e17a77719dae57352a716f2d7b1c6efc5cab8208f2b5d7a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 c0e6ee6754c7e929ebe5b4cac27469af9dcd7243b66fe4c93feb3f56c9c1a139
MD5 a784a2bb572f284671e32e70abf58a12
SHA1 9394145392bea54e881e32336c658631e033e93a
SHA512 56a4f626d01b9f24eb854ba18c57186e81f439c630f728c02360c76c9220fcf4f6edb50e8c803934919a6e744dfe41340159cf4df0543fb5fc9b47c2d68e13f2
SSDEEP 96:njk5yq1X73wpvWMoiVmdeHplwt8acWi3+UWQyV+VDCziEwb:njkn1jGWMXppXW4+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 61998e99be4e94142a9773603f22534fb3b1ec9dcd6988c68840af55abc9edc9
MD5 92767918acaad55fb79d54fef06ab30d
SHA1 3ea8bd082234b934b4becfcc3dff624470ba8220
SHA512 af7f5ace1a8cf4a4bef7d58ae36ad18200a9a670e9eacc510d53c91ee87fc44c08cc39cfe524e140ab743d80823d9c374556ea6ca31aa2fb525a5382458ee080
SSDEEP 96:njkcyq17e3wpvWMoiVmde1tYWMkdfKpylwq8acWi3X+UWQyV+VD7AiEwb:njk0deGWMnYWBigAXW4X+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 98ce75bb15d2b35609a7ad6078043b6f1ac3c58b2d82ad05d0fc889ef6e684dc
MD5 23e8f1ef42a54b6a8666fcbebe2a8208
SHA1 5a38eaaf90c5b303259301a49a9d037d0454b0e7
SHA512 f1626e98502a3e7fcbaeb478c9aebcb0754d72d48d5290f01c082e39225cc85e83729acbc776bbe017a30c9f6887c0cd87cce4b45d759609396fe0f7fef265a5
SSDEEP 96:njkcyq1Xr3wpvWMoiVmde1nuk1jplwI8acWi3+UWQyV+VD7AiEwb:njk01TGWMtukhpGXW4+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe57b18d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b18d.TMP
Size 371B
SHA256 3e47d9476ba642eae0b268a276de0648b78dca05cddece8cdfb85c4c731f9886
MD5 1dc6b75ed2beca37a4e5afadcbd493f5
SHA1 fe3aa8f5783badbbe4596f50968cf0c45b010a11
SHA512 959165c2bc3f90a3160d016525b404f2a5cfa7f6b5683ec156f623ce3ece00ce81d7257a54bad0eb5b988c8e92d7a2a6443cf680f00ed3fbf2fe8350874eaa64
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

e678ecaf-97c9-4d3c-8e06-77d91aa27f3a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e678ecaf-97c9-4d3c-8e06-77d91aa27f3a.tmp
Size 371B
SHA256 68a6dab7af74d4739c6c734c00b95768283f60e3bee504a131b9c9c95ec805e0
MD5 2bcc0f148e9e461a9a02e00d5dc58949
SHA1 de412cdbf0ce36fad9c5ad34dbcb6c79a65e83d1
SHA512 2fec61adec51ab47726940588e90bb2b8babcc123e5bab5e9e9e38617c860afa93564cd24ee010526c0de340cb3ba1b98bcc2d235b3a455dc2f5b5c56bd5503b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 065f601cb0716bbe6cac36e0352f83eec95c6111699b37c9fba3119b859372aa
MD5 bccb15687835702b948d642d4740cd8f
SHA1 b6d142321f911e7035182e023bdeaf61468936f5
SHA512 44e7fa42354f2d1416012a84b281968b19634e270c956dd2a50c310b9f7698753b2f29094c929f1615389cea5d164bf269df555b35e18c9a1ba9dae610ae46bc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupi/e2RUGPr2ZZ3z2OMDCRHw:A9iIxuERzA83h09RZxYsRPiZaOMWRHq7
MD5 SHA1 SHA512 SSDEEP

Submit Download