5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301.exe
Size 269KB
Sample240601-bre3jacf8y
SHA256 5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301
MD5 678ecb156a0c2537b9684c33943b8084
SHA1 7d869213e7d6eb2c57452f58fe908406f07eb526
SHA512 4a2766cc7821396cf9dfa6906a1ae721719efffc93c3ac6790de5dffdb9a03ac160a7ca15193e50db1710c7ec8f4fb2593d16b424302ad87fa94d83edaca1e67
SSDEEP 3072:PRPz5jk/M9Up0CpYdcvcTKLuJZagEKoDSWTKP+zT9RwfJ0DD5y/SNTo1h0E:ZPFjk/QUp0CpYdNKL0ZYWWDwfCNE1e
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3752	msedge.exe
3752	msedge.exe
2228	msedge.exe
2228	msedge.exe
3980	identity_helper.exe
3980	identity_helper.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe
5004	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1572 wrote to memory of 2228	1572	5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301.exe	90
PID 1572 wrote to memory of 2228	1572	5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301.exe	90
PID 2228 wrote to memory of 2292	2228	msedge.exe	91
PID 2228 wrote to memory of 2292	2228	msedge.exe	91
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 452	2228	msedge.exe	92
PID 2228 wrote to memory of 3752	2228	msedge.exe	93
PID 2228 wrote to memory of 3752	2228	msedge.exe	93
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94
PID 2228 wrote to memory of 2180	2228	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301.exe
"C:\Users\Admin\AppData\Local\Temp\5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd611246f8,0x7ffd61124708,0x7ffd61124718
    3⤵
    PID:2292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2476 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
    3⤵
    PID:2180
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
    3⤵
    PID:5096
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
    3⤵
    PID:4904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4992 /prefetch:1
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5300 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
    3⤵
    PID:1992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
    3⤵
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
    3⤵
    PID:3228
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
    3⤵
    PID:4244
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
    3⤵
    PID:4540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,1294199194847562583,6732101610844624701,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3592 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=5e8677c86bcb54e1e17864ae41fd99b1865725b298ca17a98f915c91cb6cb301.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd611246f8,0x7ffd61124708,0x7ffd61124718
    3⤵
    PID:1624

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2024

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30
MD5 2daa93382bba07cbc40af372d30ec576
SHA1 c5e709dc3e2e4df2ff841fbde3e30170e7428a94
SHA512 65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7
MD5 ecdc2754d7d2ae862272153aa9b9ca6e
SHA1 c19bed1c6e1c998b9fa93298639ad7961339147d
SHA512 cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 df2c1c896ed5cf730ccf8709d5ab8f669a1d1897c15734652a6f8d50812b47b6
MD5 5fb907170e39ecbe563b42069060c943
SHA1 2d96348bfbe026bb2eb14e2deb2c1944eaa51f12
SHA512 410c2898d345b2e73bef48fc65487c3f05926b2f4504096077c2d0317ac82de01f4f054b08fe62509a08bf80eecf4a74eeba9a4a14b2bc6adfd40ae12e0e336a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d42a9d885077aa9e70b581267f6fde43078c8b315e0f0bfc910a1632821e4b47
MD5 2d02b3be197fcde2def03dd5e9763d76
SHA1 ab9a1b8e069d99afa6cc3f846d78b67766ac1d02
SHA512 5083159d7965147d9cc0c02379dd0f41eea827c36c58707fa62cd16d7b1c5b8b96f762819431449b898e21f3e7a5ba32cf96fe1753085d848c539ea6223414ad
SSDEEP 96:nzkde1sq3wpvWMoiVmde10wYeVMkdfDwpylwYfpac8UWQyV+VD7AiEwb:nzkEuCGWMmwYeVBLwg9RX8rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6a4c0ff3147f98da60ebed96fc9adce4dc93d0cfe0823165b52bf0ba5362b576
MD5 15e110d8455213d6e35bfeb3a6ba43ba
SHA1 5f3671bbe02698556dfb8d5ffb88ce944f7e70f8
SHA512 2428a66659b3bd39410207b558adaf4c71cc20bf050d8d2821972f7ddf083d420df9d9ecc85d97431e99e7b4178277f237d85b7d278f98778ab3a534c3cc9290
SSDEEP 96:nzkOe1ov3wpvWMoiVmdeHplwtpacSUWQyV+VDCziEwb:nzkJ2vGWMXpMXSro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3624e11a5d189f552422a5868a15f18aa65b6a42f31716977e0299aee8baca7f
MD5 a0802e592491c5ca1fc1f02525fe5dae
SHA1 548d2abe57dee7c024c22601106c8b3109d87914
SHA512 efe493a775cdbcd7deb1f7f62236832951022e056701655ecd7679d608c3d36a7371cb1447c5f42548e621b5ac2f30cbdaa9c599c51f9ea6d575dd8b7fbb1057
SSDEEP 96:nzkde1o33wpvWMoiVmde1zuL11jplwUpacSUWQyV+VD7AiEwb:nzkE2HGWMluL1hp/XSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 363B
SHA256 a6e348d770c4b0be85c72973c529d13f41c7a7602b7dff99e6f35fb5537cc47a
MD5 103cb1b911d5f9a3782431f921b00fe0
SHA1 c45ec6965994f7666211dc80282ed71ad58cfe88
SHA512 c8e6854a6a91bc31167f41075febe1afe912c6f9a60976862b66030f2298bef7754875924d07a843ba2bbf83677cc2bb184cb11a04e406567135c2ee26f715e5
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57acab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57acab.TMP
Size 371B
SHA256 89bfd4d1eaa05df70bfb2e0ae94f1245a7c5c8837493e01025fdb06f18a852e6
MD5 fd85db778e429516220e8a947bdee664
SHA1 577736db5aed0efccf162bc5a65ca0d91d310756
SHA512 b11745affd42694c1de1c3e6557e949a9aff90fdff7ebeb4a6d7fde50772a6e46a21fedc3ad7a3a25518b17fc6aeb3b2405086254f91c40797a268eac0be8211
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 7d97190088887c4e1919c2cc7e68ef20039de5fc3ff5def0aaf8e4f4240faa7e
MD5 dcbab9904b41e5ac22bda9a866e59b1f
SHA1 7e1e893a50dd94f447ecec3433cf4b687822d3b8
SHA512 89ae2d337ecaf16713997df7da6e2d63023a63d5e5cfb0854cba34d861fca6bc8f7b8bb6510900e030662e9265a04b568be506ee93fc52837e03075aa9a7e2e0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsDe2RU7R2Zt3z2OMDCRHq5:A9iIxuERzA83h09RZxYqsYtaOMWRHqlf
MD5 SHA1 SHA512 SSDEEP

Submit Download