4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
29/05/2024, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2.exe
Size 236KB
Sample240529-chfhdafa66
SHA256 4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2
MD5 cae496fb53afcf575266c32b4bdf4e2d
SHA1 da199c15fe31b29dd16d73177b5525008b472480
SHA512 7c64a7ccfc8e22d51a5ca0dbe8d2d615cbd99941b4ff24fd3b03abaa20cef7ee565d9341651274e855ec75053716fe49c64c2b57ae0a5227a623ac11f0b8ccee
SSDEEP 3072:Bee1zN3EB7PkkE0kzSDlHdGsVI5sFxcRWRt5uz4eV5:3xN3EB7PkkE0kzIXGsV4sFKSK4o
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
3408	identity_helper.exe
3408	identity_helper.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 4916	2780	4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2.exe	91
PID 2780 wrote to memory of 4916	2780	4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2.exe	91
PID 4916 wrote to memory of 372	4916	msedge.exe	92
PID 4916 wrote to memory of 372	4916	msedge.exe	92
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 596	4916	msedge.exe	93
PID 4916 wrote to memory of 1632	4916	msedge.exe	94
PID 4916 wrote to memory of 1632	4916	msedge.exe	94
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95
PID 4916 wrote to memory of 1088	4916	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2.exe
"C:\Users\Admin\AppData\Local\Temp\4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf4d846f8,0x7ffbf4d84708,0x7ffbf4d84718
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
    3⤵
    PID:596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2592 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1632
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2992 /prefetch:8
    3⤵
    PID:1088
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
    3⤵
    PID:3528
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
    3⤵
    PID:4052
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
    3⤵
    PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    PID:1848
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5332 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
    3⤵
    PID:2380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:2972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:2572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
    3⤵
    PID:1308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3548 /prefetch:1
    3⤵
    PID:1956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3110680743540686270,4803981488632059807,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=4e165afe7f21461d4fb2a92ddd86bb6b3307a51ac0386b8482d32e96482f4fe2.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1488
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbf4d846f8,0x7ffbf4d84708,0x7ffbf4d84718
    3⤵
    PID:1712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b
MD5 c9c4c494f8fba32d95ba2125f00586a3
SHA1 8a600205528aef7953144f1cf6f7a5115e3611de
SHA512 9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8
MD5 4dc6fc5e708279a3310fe55d9c44743d
SHA1 a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2
SHA512 5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 fa5c2e6870e9bd0cc5c812861838ae519bf7386ba51f9471c7738ad7bd1ce471
MD5 87c37fd985d73a2d8f1a732d99f74f6f
SHA1 8776afcb4605c1a72f2e0c7b389728ff2b78c792
SHA512 1cb535240a9668618bc40dff55f512ecc37678b82f1b416d1e6dd0188603fb3b4dfecafe77cc1883030a42a2fdaf28bbdd3c552a9056f4b985f5e4e2e56ee979
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cde938ad815729cbd8155abf58a98e74853abb25824539515fd692f474668c75
MD5 e44244e9f70c0c304bfb6b7a33eec156
SHA1 157d9643ba2cf1168f3736ce52b873708f3e3795
SHA512 57c6f22fda10f76245b16880fbd689db22aab23e8b9b4e00153bb26b9e9b2ae71d454bf3563622a335febff69361c9076968893ccf82dc47be8b735dac11808d
SSDEEP 96:n/k+2Y1m9wpvWMoiVmde1nusS1jmf9UWQyV+VD7AiEwb:n/kWc9GWMBuThyrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dd21dfa158cf3db7df9ee76e6f909b000f0b9b0b17e8fa06d5c9913acd1dbdc3
MD5 c3296a14f86d18c97be7ec7a11263938
SHA1 cc33b6bdb9c8b907c2166d63e213f71cf86f622e
SHA512 a14d484aa9af87c3f773f47264fe5bc47df552f6eff5dee77d03dfdaf031600f643237ea4ff4429bd2f27fd5d2a37f50804a8d832fd056447702166f1e9bd99d
SSDEEP 96:n/k+2Y1+4wpvWMoiVmde1rYv4MkdfsplHsUWQyV+VD7AiEwb:n/kWI4GWMNYv4B00rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b98208444fda9c03ce9b7ec98b966a10f6923f88b261ecea774476caf33d6a3a
MD5 5f1bbbd5f86a0b565e94bbd9650c5a6c
SHA1 4dd59aa523ed39deaa9ed5741450ea34e0d30be6
SHA512 a309aa80e18307bdf784f9f8234c8c6946a31bf092ec48659693f38c2009d7f9c90b3b888a7c8c8b25c3b3f52f8357c40ead9c886f7da48c2b50328ca3fd2eda
SSDEEP 96:n/kr2Y1m1wpvWMoiVmdeHm09UWQyV+VDCziEwb:n/kNc1GWMXJro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 97142943d43e70c9a848dea8034ca9042ae5d4f712cc8206a67d0a4da0fa4da9
MD5 7908c01c7977f0b905b2388fd5f6b586
SHA1 d9e055f4d65fe8fd8ce87ce141fb0dc95a02ab44
SHA512 35055aafd8186f68706f4cb451c4e86ce7a894b4e8a018f9757a8bf8b9a0e3283f5bb9e7811edb23f156fc9906b8616e648105e7cb81f8e7683f58b1cd872d7a
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57be00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57be00.TMP
Size 371B
SHA256 21dc20930450e9d590461399191a12c32d1aae4370b1cc9da5aec5c85da175ba
MD5 bd71bf82edb2deead699d3754f6b5899
SHA1 41fd7692004cfc7b909904e79fcb82666c6355ef
SHA512 8108632541802c584e21d2cd2b9ef9915de611df3dde7ee4d6499762037c298ebe47bff18b31d8b6d4a61edcf070b43fae2346881870719ce7dd9403558b6253
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

a6fb133a-9794-4ce7-9806-0583f7493911.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\a6fb133a-9794-4ce7-9806-0583f7493911.tmp
Size 10KB
SHA256 6b9ad55a2e86cecf8dde983ea2c5ae0a764890ebad2587f7401e8c3473ef216a
MD5 9bfb2905032f24d5a434504e1acd85d7
SHA1 b88cd7865de5b5634794fcf241479ebce81f925c
SHA512 0a3580ac4303f3b18742f8eab93b2e6cd2b95ce1e60e93e7688113205de798317ff0bc7860f40aaa5b75a0f8882bf46c82e7b1fe3fa233e60aab31aef57341ea
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupiqe2RUjez03z2OMDCRHqll:A9iIxuERzA83h09RZxYVd0aOMWRHqlWs
MD5 SHA1 SHA512 SSDEEP

Submit Download