e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998

Analysis

max time kernel
138s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998.exe
Size 234KB
Sample240530-beyn4shf43
SHA256 e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998
MD5 367f41d0b69753af90a7d47c37692de9
SHA1 cb29391a33f890e9594e82b93b28d26f87b01836
SHA512 bfc1b168d386ab657932f4aee8a5dfca1a09df3af323ff12377a5cb71fa113add5cd2d74ec73fd9d9d749a191440ab1faa23a156325696dcb677814c243d8023
SSDEEP 3072:+ttuyGC+NGD1w5pbDoiWEPvq7ac25RG1VfD:+ttuyGC+NGhw5pbUvEPS7ac71x
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
4684	msedge.exe
4684	msedge.exe
3300	identity_helper.exe
3300	identity_helper.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe
2788	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 4684	1088	e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998.exe	90
PID 1088 wrote to memory of 4684	1088	e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998.exe	90
PID 4684 wrote to memory of 4252	4684	msedge.exe	91
PID 4684 wrote to memory of 4252	4684	msedge.exe	91
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 1872	4684	msedge.exe	92
PID 4684 wrote to memory of 652	4684	msedge.exe	93
PID 4684 wrote to memory of 652	4684	msedge.exe	93
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94
PID 4684 wrote to memory of 4876	4684	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998.exe
"C:\Users\Admin\AppData\Local\Temp\e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0f7546f8,0x7ffa0f754708,0x7ffa0f754718
    3⤵
    PID:4252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:1872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2104 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
    3⤵
    PID:4876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
    3⤵
    PID:4620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3628
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:4116
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    PID:2516
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5292 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
    3⤵
    PID:4824
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
    3⤵
    PID:2676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:2700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:4880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,3592034148640118866,40786084176199202,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=e170ce6de2031b052a72dbb2d0c8f3194bd4498c0ca4e3b4f5ae5177f3b1c998.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:5104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa0f7546f8,0x7ffa0f754708,0x7ffa0f754718
    3⤵
    PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 7dca0fb79ed045a68632949ccc894f3e9ba5580ebfc8ccad8882f73e07ac70be
MD5 bb81af80e210211bd74e0455f1944e69
SHA1 aaa3d92247a8db96409268682ef40d55882f05a7
SHA512 f9afb9874d4aa9cbd1bf9be0ea6756b786ac32eda7e7f7e91f1fbe8527f46a864c0a0f235f731b0ed151ff9a4947de7b04e3ad6f3e352c42ce8797d15223b0ed
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4e8a9f30a943aa9f1494c5459bd98b5189a4d07a4cc6475f4894e621df8cb76d
MD5 5123103ef82d9311aba69a2f4fb8c80b
SHA1 4a71956a14f20a849841b92df5fc55aa0898eaba
SHA512 8e716a391ae6a44e680793985b6fefa4b9866fbfead445ef56e16edc655bda1e6e941b88853f0aae8fd604e237590fc6e65d98e006f87f9a85b22c881e0e20b0
SSDEEP 96:nckMj61nI73wpvWMoiVmdeHplwtKacvUWQyV+VDCziEwb:ncku6yjGWMXpXXvro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 80abe88619987934b9e12d9373458977be82afe28eb6f1211a11217be195abe5
MD5 4896366bccd791edad6c71f9e5e4581b
SHA1 51fa4ce0aa1aa9d7c1d52dcc29be9fc5af4edcdc
SHA512 7b61985c0f0ff56772ea17eeeab7293a4f87fad0fef82a45345c97cee86239eb2e11d3d67e598720505bfa3a22251ac5469ebd9a3973dbcb3b3f1fe02c74a881
SSDEEP 96:nck7j61nMe3wpvWMoiVmde1GYQ4Mkdfapylw/FKacimUWQyV+VD7AiEwb:nckX6SeGWMQYQ4BygxX3rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 15076bd43c78c00cd003a37165b698ff5714b8227f369c141300c0c0f383ba09
MD5 2e1ff5d87502ef17177b5dc44f9fe5af
SHA1 71f3ddbfd52cd6095901f49dafd29784cb7b965e
SHA512 523b30954e69ed850d12267e7a8fea30ee8ac76e8d49e83e77c27e14565269efca7688550ba94d0d3e2a2844e575475a67fed606720f6f3c63f54d517326e071
SSDEEP 96:nck7j61nIr3wpvWMoiVmde1Nui1jplwmFKacvUWQyV+VD7AiEwb:nckX6yTGWMDuihpaXvrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 9aabadf1409d18eeb72c766557acf85995756224427251f77e4e8630bfdd9fd8
MD5 06a94abd5d00a3a3214dce176e88a96f
SHA1 4fa0a41848a602df2cdb91af822818fea1e1635d
SHA512 63e32488d64d4c9ac8430e367415af587771e1a9088a722c57ec698b20065870b02bd7fea9b1b016e7b72958fcb0e6f2730a9a49895567687c09677891779240
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a47d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a47d.TMP
Size 371B
SHA256 a792027ed418b66f32bb152f312a4377958bdca80deac7f01c2874998f565d7d
MD5 d30f148f79a02dffff2f60731f58be3c
SHA1 4e30c7491e62c59e629bb1e27a0a7dd358c2472d
SHA512 628fe93bdbb842d58dec5f60ee8d721391090f404d3acfa2f0acb1d68f1f2bbabf27ec8e72559ceaf3d9580e79ae2a3917474228de7d0a006504588dad303ae3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 40dd7cea01a4c099bf712f437f1fdfd6af1812cbae2606500cc9374d6541bec5
MD5 699dbc7d815c9f97776285782fa82ff3
SHA1 029cdcdd0c0d9622f1d07d6600293849fe192504
SHA512 db5ad922f740d52c2aa3bf03c6eb15fe95ad2eb2beab658f8d32b97f5c619ba3d28a76619a7e10ceb6a4f60db5811a859bb9eb063559ca55482f2d099d8015d5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupD1e2RUP2ZP3z2OMDCRHql8:A9iIxuERzA83h09RZxYl3PaOMWRHqlWN
MD5 SHA1 SHA512 SSDEEP

Submit Download