5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79.exe
Size 164KB
Sample240601-bq3gfacf7v
SHA256 5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79
MD5 aa874a2387f2d67e59e357253bd52f9a
SHA1 8a3c885618c2e795fd96963df0ddf19e27071c23
SHA512 3cf3e54a15ec5475a327d0ace4e59ff3be5a9415c332442105c9cc2f4492f4791e70d3d043f0980288a18c3ae3d3e34cdc8a958469347d2561c2ae9a40a6d9b6
SSDEEP 3072:KsvoYz+SuPDy2+9cC46t0xdeTyCxOkteRDWN8Ytm8YUfg/VlPpvqW+iA:nvhz+SuPDy2+9cCdsdmyCx1t+D12RfgV
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
2880	msedge.exe
2880	msedge.exe
972	identity_helper.exe
972	identity_helper.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe
1404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 2880	1632	5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79.exe	89
PID 1632 wrote to memory of 2880	1632	5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79.exe	89
PID 2880 wrote to memory of 2008	2880	msedge.exe	90
PID 2880 wrote to memory of 2008	2880	msedge.exe	90
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 2272	2880	msedge.exe	92
PID 2880 wrote to memory of 4832	2880	msedge.exe	93
PID 2880 wrote to memory of 4832	2880	msedge.exe	93
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94
PID 2880 wrote to memory of 3212	2880	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79.exe
"C:\Users\Admin\AppData\Local\Temp\5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff461846f8,0x7fff46184708,0x7fff46184718
    3⤵
    PID:2008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
    3⤵
    PID:2272
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:3212
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:4648
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1996 /prefetch:1
    3⤵
    PID:3584
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    PID:4588
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5140 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5288 /prefetch:1
    3⤵
    PID:4780
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
    3⤵
    PID:4076
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3660 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
    3⤵
    PID:2020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
    3⤵
    PID:540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,10572414436599890361,2553046912404960949,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4868 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5258c6d1bfb7075069f153a8aea5615d5787746df65ba0e53c090ee6ec999e79.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff461846f8,0x7fff46184708,0x7fff46184718
    3⤵
    PID:4160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3304

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 e728aba5ca85cd28f0d9ae9abd9cc5bb27ea176a3f399c00337b829e6fda089e
MD5 f4cc93932e5e0aa3f5e47cf54416ec18
SHA1 3a71262b8c5b94f1080bed6e98b323bc10b64d24
SHA512 94a5dd6cf9f58b34baefb8527ced264ea2b8f47ce2f9750172d92efddd178a5f88ddea6a7f0870800e055b401bb5494d59c6f1abab99610f8cf3dae32f48a8f9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f8fb9519427f556494062461677fdbdb88e8fa9b4f350b3132b19862710e847a
MD5 e1319d8b94a36e7be005f73b5aa6c88b
SHA1 ecc184a5433339ae3f03777e61de5d4c228332bb
SHA512 21b34b1bdce03346c4bc8194ae2f3eb0f79e6362b1de55234f69f817acf2db326838d8a7bd46bc39a142494afb8e8fdfadef513cb2cb2524c4b05010e3de07d0
SSDEEP 96:nyk7Dm1ve3wpvWMoiVmde1NYKIMkdfWpylwiMaclUWQyV+VD7AiEwb:nykPmteGWMHYKIBOg0Xlrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3b241a98ac918469fdf8216234fbe5be47f58ebbbe361086227233712eadd429
MD5 9b382ada864541a05c7561cabe1e3c3f
SHA1 9491face4a2e45cc636cdc67f08eca0f0641dce0
SHA512 24ccb81bff8dc27c9abc3fc71e317d8bf4967af6f53645bb0c1e00e86691402bdbc971cde93432f5cfc0166feed2a14d32931b5d1b7cc0e6f2bfe6a6dde4388f
SSDEEP 96:nyk7Dm1zr3wpvWMoiVmde1qui1jplwZMacXUWQyV+VD7AiEwb:nykPmlTGWMIuihpbXXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ec7360dabbe0b66fdd8646e7803726af89703e01d1888373710fe1c5d315ecde
MD5 1a2387d686320eada74b57bf5df95151
SHA1 88c506c1cfa674bdc2a222ee68c97206d81d7e71
SHA512 1b1695302624d2000d51b3611c91eeb64caf655c197138c541f95f2e3a2f3003552865f5263529a7d96631b37c02f8b0385e83da743abc47932030cec475e202
SSDEEP 96:nykMDm1z73wpvWMoiVmdeHplwtMacXUWQyV+VDCziEwb:nykKmljGWMXphXXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 ba51319756b5de9c97c348d6fefcbeffe0d922b00a978ce5d3b21039776b4064
MD5 4c37af5122b5e06e64360859994b58fb
SHA1 ddcce238d5a70400c3cb7c28c9c6b0b11c193d8e
SHA512 bdc915f76d7951facfafc867e46d042f076c941a89b529f5fd71bc559f15e98418653279d8901a56877c6fa8047ac7645604a97440c375e5b92f3eb731c39d2d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ac8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ac8c.TMP
Size 371B
SHA256 448b701c8d232b6a583c082888441e41bf57163082de9bb5ec96ca067c25a8b5
MD5 01dac8816788634711d465a2ba7dd6a6
SHA1 1ea6404138753177833874a6526c2367c593afb9
SHA512 73186a8973df0526c1404fbe9de219ba4214b5369a686b6555ee3281056b77a1f9ab60cc5c3ccaf0656ad04d1fbe44424b71d3835ff4acbc07a198ce0b9061b2
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 c6634e134ca0aac87aabf275eb4834062c9d12560f5045801e7f2946ebf503a2
MD5 ccf269b7d55dc68aec0c3258d810a91a
SHA1 6e5292220906ccaaccfc3eea37c4a7b3c02d926e
SHA512 1ac14dd813ccc774c12d92ae183216f505d9f4e4f0842ebf16c3991892580f7c04e10479672426f986e195ad2e8f0defcd223f6206c50b883f13a3f31aca5f82
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZae2RUWh/2ZfL3z2OMDCRR:A9iIxuERzA83h09RZxYipGfLaOMWRHqY
MD5 SHA1 SHA512 SSDEEP

Submit Download