78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a

Analysis

max time kernel
139s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01/06/2024, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a.exe
Size 164KB
Sample240601-btr5wacg71
SHA256 78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a
MD5 02ec4fbdeac4ac060ee0455693e63a8d
SHA1 09145061d105af8d5f664e2cfe15c1e29556a8ed
SHA512 7b39a38e434287fa37d81ee7f8289510f92dc27656a4241b5c090e2c179ffb3876d08daaefef4b07648c9b0fafbd3e297340956e098dd859cf5400f58087f265
SSDEEP 3072:RjFoDkSRTorXgwIEo+MzRyRUJGLtY2hq/0Sd93j/+0KqRXjYrb6D1+c:VF6kSVorXgwIEod0RUJG6fdt7KqZYS5+
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
1284	msedge.exe
1284	msedge.exe
4108	identity_helper.exe
4108	identity_helper.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe
1284	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2848 wrote to memory of 1284	2848	78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a.exe	92
PID 2848 wrote to memory of 1284	2848	78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a.exe	92
PID 1284 wrote to memory of 3820	1284	msedge.exe	93
PID 1284 wrote to memory of 3820	1284	msedge.exe	93
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 3652	1284	msedge.exe	94
PID 1284 wrote to memory of 4328	1284	msedge.exe	95
PID 1284 wrote to memory of 4328	1284	msedge.exe	95
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96
PID 1284 wrote to memory of 3120	1284	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a.exe
"C:\Users\Admin\AppData\Local\Temp\78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x108,0x10c,0x110,0xd8,0x114,0x7fff28b546f8,0x7fff28b54708,0x7fff28b54718
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
    3⤵
    PID:3652
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2956 /prefetch:8
    3⤵
    PID:3120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:1860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:2536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
    3⤵
    PID:3828
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    PID:2176
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5228 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
    3⤵
    PID:3460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
    3⤵
    PID:1484
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
    3⤵
    PID:828
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
    3⤵
    PID:332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
    3⤵
    PID:4268
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7131192039659787048,474572089083679252,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=78af14dd99bd711ce9442a78b5816a7b25dbf66bffb273cf2e85180074303b4a.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff28b546f8,0x7fff28b54708,0x7fff28b54718
    3⤵
    PID:5044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4
MD5 1ac52e2503cc26baee4322f02f5b8d9c
SHA1 38e0cee911f5f2a24888a64780ffdf6fa72207c8
SHA512 7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6
MD5 b2a1398f937474c51a48b347387ee36a
SHA1 922a8567f09e68a04233e84e5919043034635949
SHA512 4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 a3afae0ceb331a9090af53adc44c29e3f1b1b3a37e0348836615ed971540c4b8
MD5 52d9293f2837d60cf293cfdaf5991601
SHA1 63f5c319e795c8f4b59ddfcd212f58893faf27a6
SHA512 f99963ad3b8ddbfb0650519ceddd47f9aac3bae2a2ff4f240d9a461960e762bb156579c0f976892f22609316d68d61d213f54b2438ec7386b6a60e093d3705bf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 129f69b54c6383cbf307898cc33a6773df1d488eabfb14cb655c2b9d5e8ab9a5
MD5 d5d53001436398bc119030d050e99d28
SHA1 73035c3d44697ed2821f99697b9aab853ad2162f
SHA512 c5d24042f2bb38ed567ddb88e2c8bc6a5a549469792642e4af95d4a242cf8532b81874672b87ccb96ccd80f87132cbdfe07353e00cd8a998a457d5fc23605658
SSDEEP 96:nVikO11iICga9IQwpvWMoiVmdeHpCrnbdUWQyV+VD7ziEwb:nQkSsIRaCQGWMXpobdrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3cdf88b3703ff9737ef4fa272e06249998bb2903dc3faa81764a90e5669325bd
MD5 85af359ccbcf5a68804f2530d9ffba01
SHA1 79b465549f2d008c1524b2f8f24a02e8cd28f440
SHA512 e10c85da0ebe5b02760f55ff0dbff27bd16b21c80f57ed9bb549ab229f1ee84c367e607a54e12860f0bc48ccc83af063e9d6c1f646b0eaa69c13e41c736bf016
SSDEEP 96:nVikd11iMLga9IQwpvWMoiVmde1KYMMkdfhpyCbnbdUWQyV+VD7AiEwb:nQkrsMEaCQGWMkYMB5gebdrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5d00a4bb3abaf1bc47ba75abf4b2ee618a8e00f50befcc564767e870b3a0de1d
MD5 e9cb4ef6227cdc4d88f9bc8c3195edfb
SHA1 40b82e94a6a773f6744b0f03ae956549be2f2eaa
SHA512 4e55e20ff83a9aeed6031101f9721d7b19a50316874c5150427b0f80a73be2abdb6f80cdc9927b1308e25a9c3a70a57581a62558af7d4f91619cc9a1694c89bb
SSDEEP 96:nVikd11iIaga9IQwpvWMoiVmde13uv1jpCenbdUWQyV+VD7AiEwb:nQkrsIJaCQGWMduvhpXbdrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 232fd0acbbd5cb4324feae1172ad965cfac927eb94a4b0fee18b31fa7e8389a7
MD5 8e53b1a61b32a7c98964ba1dfb443af2
SHA1 2cccc2db0d7d0d3a514ef22ee36ced54a508fc68
SHA512 5eaff284287bb5fc8d2499e585bb0b6707bdc6825c07c7c726c0aa556433e8d08c9ccabc14ad2b7d4715679c8776d369260f3cf086c0c876689a8f14a0016138
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57dd7f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57dd7f.TMP
Size 371B
SHA256 84247b53b196c70bd717526a3f8995044575de9d2c355bc8d3c624520d79d58f
MD5 fcb7e1c71699c6c38333cb4bc2aba789
SHA1 f512b209e5b6cac98e9dd0bda9bab1e46160cdc8
SHA512 bf22dad1c110f21acda4ee8c18b0e18ed159d890a35e76bf694aa4e1b1cabb4fd5fd08d2d8fb458db2504e3a172507b473a1e172675bc139c342acc375182e98
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8cd203c51e966035e33c20c708abe56dfe46f838829d77d496041bbde640c565
MD5 562ca0ffa07ea3a8abde7f22d13574c4
SHA1 3bd0f1004b5c256a6cf70f7f7bb9e6ceca2b601d
SHA512 4ac3802ae5b9ad24fe4057bf1751f111b9ccef48ee40f20c15965476315210334054d1f4b25a8ea73182d2aed527c940a325b4e7ae5b01033e48e234e87f86bf
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvkJe2RUzjf7ZAL3z2OMDCR:A9iIxuERzA83h09RZxYvkdqzZALaOMWR
MD5 SHA1 SHA512 SSDEEP

Submit Download