53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04.exe
Size 164KB
Sample240527-br7sjsbc5s
SHA256 53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04
MD5 057f444c5c6e4c06dc8f192038deccbe
SHA1 47aba9847f16c715570afcf1cf492bbd40a2a35e
SHA512 42edd920d08ff476576fdda2d251aa7ecb4579e7c9449e7e8be58f29eb88094e7fa6e2c2ed32adb7705fa06002e2fb0275b86256753ce96cff4b53a5e40e637f
SSDEEP 3072:r8m+lMpBDWrvLDAXUo/nkjmhUwn6ORi4P5rJew:r8m1H6IU2LttJVe
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
936	msedge.exe
936	msedge.exe
1924	msedge.exe
1924	msedge.exe
4356	identity_helper.exe
4356	identity_helper.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe
1924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 1924	2456	53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04.exe	93
PID 2456 wrote to memory of 1924	2456	53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04.exe	93
PID 1924 wrote to memory of 3704	1924	msedge.exe	94
PID 1924 wrote to memory of 3704	1924	msedge.exe	94
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 2936	1924	msedge.exe	95
PID 1924 wrote to memory of 936	1924	msedge.exe	96
PID 1924 wrote to memory of 936	1924	msedge.exe	96
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97
PID 1924 wrote to memory of 888	1924	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04.exe
"C:\Users\Admin\AppData\Local\Temp\53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1924
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91d246f8,0x7ffb91d24708,0x7ffb91d24718
    3⤵
    PID:3704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
    3⤵
    PID:2936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2580 /prefetch:8
    3⤵
    PID:888
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:2804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:1716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
    3⤵
    PID:1804
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    PID:3968
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5056 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:4012
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:3188
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
    3⤵
    PID:1472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    PID:628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
    3⤵
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,3546645788800452986,15353627313409734068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3640 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=53e1a5b19a2e8f6350aa31ce7d0162841545d264bf4a29a9c9ad6fca7871ef04.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb91d246f8,0x7ffb91d24708,0x7ffb91d24718
    3⤵
    PID:2716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 7497a46ebf6120a59047b5a14df6ca8cb06f0043ee9eca70a9ca0858eb0dc3a9
MD5 00d9317f3226af7ab41cc1652c881a06
SHA1 8cb85eea63f3af2fb9068b6abb1014ddfde5d61d
SHA512 a58cbc747b370fab7a1ca5ed636854f6e07260b2616e46dee334094caca25215973e2524b64f0e7962fee507d9126141bd0ff4f56976c06468ebcd8393a5e6b8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ba24bc98136fc02e500c0372a70195263ccf5cdfedd8e6d8c0edfe1f40f33c02
MD5 06b36e38783cbf4905086aa1978b79e8
SHA1 e71f45372608d8e6da78f9bc8c2d2d3c499d855b
SHA512 ec530cc684626723c836d0e71caf529a0e1f70447ac8a7a569475023dd503fbf11dd7b9d7a814806463fb95e4b97ca21332d7523a277e4f61830139e78c464ab
SSDEEP 96:nBk5K1fTjuwpvWMoiVmde11YOMkdfapcSL49UWQyV+VD7AiEwb:nBkYVTjuGWMfYOBS0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 07a0306e4a002eff925ee1ddecc29b39c33f4c8376537114412378ad0196ff39
MD5 268d76fa3becb228b2ec7a653225ef61
SHA1 22af8dd2a8c713560595c6d550f2616f9c7edbe1
SHA512 1ab635177f6dfb6bf8a2728b4e1860a3e59355c8d49a24151789e190fe60e7d46a059ba6208fb951ac9a6ac754085763bfd8be9617f5302ee19b7519ce1d3d58
SSDEEP 96:nBk5K1DwjuwpvWMoiVmde1Cuw1jvSU4BUWQyV+VD7AiEwb:nBkY9wjuGWMouwhKrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 72a09ca543f2c609e0e4900a9f45869817fd94d3818c9a08d4c0a70f38b81a65
MD5 96d1ce74f6c3e28b15a7559c3c13129d
SHA1 e7884fd3988d1fd4ca0a5a5cd4d5b994879f3884
SHA512 03a4edc7bb837c7eb830230342015d51e464cfe04e835510860f33c4ef943a8f73c9637cdc7752ef8445e381fed9595e602db5338e7e7153e1759e76c3e95846
SSDEEP 96:nBkiK1DgjuwpvWMoiVmdeHvSS4BUWQyV+VDCziEwb:nBkh9gjuGWMXuro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 367B
SHA256 cd161248ba675ad38a74563ddad9ee89e31c4189c15f19b1102819647a08eaa0
MD5 e6d8ed66cfcb31d53431952882e969a5
SHA1 963b9d944b75005631eb6762c147c9877c447f29
SHA512 6189e69fb161716f4a05c72b93e1494cedef7268abfc85bab3690e323ded80dda04be51d2dbe79dd69f480b20c6c50170d604ef8919a733fca8b319ca1941a3b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 367B
SHA256 78e84f05a71916559c9b2653523534b230a90902dcec4739db1e04d975973b2b
MD5 b55d5d502c3f729d30d6793a810ab472
SHA1 0c33a958f476334a469bfb87f0fe6b9a7af5eeca
SHA512 db1670f20dcc0ab1a1414c2ad2eec7152d6cfe47551c797cd2236197b83258bd5d7580c0db61790fd1bf4d1e2ce0712f52ca36158a848db5fb09d34091251ff2
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b21a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b21a.TMP
Size 371B
SHA256 c9720c4b7627a063944a1f43780bc03fc5d0594b6962f920741f8ca825a7810c
MD5 e4f879985a2ba3ae74fe358872f27e76
SHA1 ab4fff6cb590d61b2eee2023b82b0a42cdc3b2ac
SHA512 ccb6b89f855d9060460a450fbd2e339c2a19943645eed4161d0cde448d41b32a370b57993cbf6e2bcc14206b768abd1d6f340fddcf8da9dc03f15d83f3628378
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0cba96bb2221873d610529321fb921b4f262ecb69c4e676f3cf4427157c3e276
MD5 ef78d047d9467dfbc3e27a470e77a4ac
SHA1 98ce325c4a76ecb17687fdbd4e860ef06e8cac75
SHA512 191bc64af3b10cbef7a0baf5f8c3f2a7f4b9f876bc09983b8eb703164fb1dee1d5708ccecf9761c9a0db41a670c1c364ba799cfb4cb2706f8d0c6b651ede8b5b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupIBe2RUn4ub3z2OMDCRHql9:A9iIxuERzA83h09RZxYIVqbaOMWRHql9
MD5 SHA1 SHA512 SSDEEP

Submit Download