6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 01:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee.exe
Size 234KB
Sample240604-bejvysff7z
SHA256 6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee
MD5 042f4a80de612b1b2c4096e6a551a53b
SHA1 91633eb73aed85e2cbab238ed1e22cebeae9567c
SHA512 81cdc8ea36c3c393c63f607d5480ffa11f6c6a17952a8f7657cb5b19e76e23ee1b62780b52b98cc7db950b9390892d2a2f5d18e235c0179ff57cb4c23b5db4bf
SSDEEP 3072:qr6mlI84UopFfn4bQe/JsjOpI5x/QPwEd8:qrvI84UopFfn4bQfOpK/Sw0
MD5 SHA1 SHA512 SSDEEP

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
1132	msedge.exe
1132	msedge.exe
3604	identity_helper.exe
3604	identity_helper.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe
2592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe
1132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3296 wrote to memory of 1132	3296	6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee.exe	94
PID 3296 wrote to memory of 1132	3296	6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee.exe	94
PID 1132 wrote to memory of 2472	1132	msedge.exe	95
PID 1132 wrote to memory of 2472	1132	msedge.exe	95
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 4292	1132	msedge.exe	96
PID 1132 wrote to memory of 224	1132	msedge.exe	97
PID 1132 wrote to memory of 224	1132	msedge.exe	97
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98
PID 1132 wrote to memory of 4584	1132	msedge.exe	98

C:\Users\Admin\AppData\Local\Temp\6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee.exe
"C:\Users\Admin\AppData\Local\Temp\6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4acc46f8,0x7ffe4acc4708,0x7ffe4acc4718
    3⤵
    PID:2472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
    3⤵
    PID:4292
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:224
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
    3⤵
    PID:4584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
    3⤵
    PID:3260
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
    3⤵
    PID:2684
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    PID:1080
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
    3⤵
    PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:1428
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
    3⤵
    PID:3468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
    3⤵
    PID:2976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:644
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,669137573731441169,12770111852801904154,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4928 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=6bcb92e4485beaf598b103eac8bae502ffa58e97908eb492a16e4ac99e8049ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:1316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe4acc46f8,0x7ffe4acc4708,0x7ffe4acc4718
    3⤵
    PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc
MD5 4f7152bc5a1a715ef481e37d1c791959
SHA1 c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7
SHA512 2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6
MD5 ea98e583ad99df195d29aa066204ab56
SHA1 f89398664af0179641aa0138b337097b617cb2db
SHA512 e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 de69a806ad0fc40f6c823d76c02bfdbf1c1021482e4650032872448d9376700d
MD5 12da4edaf117c1db5b1a44c4c380117c
SHA1 6cba39da11174836ad554fb97239ecca93b1e9a3
SHA512 6070a04f9f7472b5683c941c59ea419a1a0439f229371e01cf4e29c06889300942ff1e74aef5ac9a1d41b4a9ec812eeac9906f4499b8aff3b97c6af7077ec06b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 78f004677183ae207c2dce8d38db79577606467af8222f916bfe96034a8d9cc6
MD5 b70997dc68c7bbe61c112c86242d404d
SHA1 0f5bd67449c8effd70b4610499789acfaa40b1f1
SHA512 bb67e766d660c046cfe33e930f2765c40d4a217b7bab41d7288e92608b59de8e6fe37be9619174d0d13c8eeff1bac3494a7095998ac5e17f4af5b3fe00bffec4
SSDEEP 96:nmpkM26B1i33XwpvWMoiVmdeHp1kAfUWQyV+VD7ziEwb:nmpk96BknXGWMXp9frt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c771412b504ac1a3970bb6a688e87c37d7f2845ed81b8ca9064654c46e2520d8
MD5 05c3e8e32f1d38d8b8847177321fb690
SHA1 01e03958e5c1dab4506a5a957173de6d283962ac
SHA512 20631f4ff194275029943f02ca27fb40620036dc77b82fcd8e6313bb1bb5bbbe439c5d9c2bec1b6bb89c2d19e6882fc60cf0f58faa0b4be2c23066ddb9989de8
SSDEEP 96:nmpk726B1iU3XwpvWMoiVmde1gYKMkdf3py1QApFUWQyV+VD7AiEwb:nmpkK6BgAXGWMGYKBPgJpFrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 44171d9b785fd2710c1ce27016a06eaa2842a55e2dbc101e643151d3884bc229
MD5 500067fa3cd2437bc4603c10b8dc686e
SHA1 6cdc3eed92c4602c178e933e5ee5a67f58c3aa41
SHA512 05a00e276d885483c040f384bf589549c41b5b6195b7aca1cdf223d6c9efd11e528278bf4e9ba900b8ddf5fd7402efc755dcb1edfb95eec39dd331f7e501f3e1
SSDEEP 96:nmpk726B1in3XwpvWMoiVmde1nuN1jp1DAfUWQyV+VD7AiEwb:nmpkK6Bk3XGWM5uNhpafrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 07300e1026897c2b4acd87a621025ba83d7f9823b5a094400a8535795132dd60
MD5 d3d65101f3db159fdd820d5fd1233b60
SHA1 7d640da2ec34ae131ed5bb2c9f6cfed29070203d
SHA512 fb392e82df4839bdf6c80bca6c45dc1f16c6bc34e123ec822d6a04be23ad62ff333bc615a69c1dce2965eafc4c347e9bcf4c735c92ade700020a319228c50276
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ece0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ece0.TMP
Size 369B
SHA256 f38285c498a620ae5af50aa7afc3f6a5dd8da78874b8d59737efdadf385e0cdb
MD5 66c68fe4a17fb1b6f0ac8151530e3534
SHA1 6ed04ac8cb577889fb1ed205eadad3058e1f92c0
SHA512 ee29002586aaf1f4850c84fc09ad683424a24c0e686180480d4e6f3b6a935d057e5935e186b7bf11bcd8d28fe360d3f2fee4276ee629bca648f82ede11e5b26e
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 973aa371302b1e9e9a2a1b036c2286b54ef5327c2ea275fea22cd010e37936df
MD5 effd0f63009d2b922ae0a80000ba9859
SHA1 35098665ca06aac957c8f8d1976f05b0f1c20756
SHA512 9e39657af29bf95d850781493ae159a9e4cf999c8576a94e7cbf32a31dbeae7af46ace7a850c47b1132293ac34ecd671230c1192797fefede3fc05559fe655a6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexups7Me2RUIo5+3z2OMDCRHq/:A9iIxuERzA83h09RZxYs2g+aOMWRHqlR
MD5 SHA1 SHA512 SSDEEP

Submit Download