hxxps://github[.]com/brechtsanders/winlibs_mingw/releases/download/14[.]1[.]0posix-18[.]1[.]5-11[.]0[.]1-ucrt-r1/winlibs-x86_64-posix-seh-gcc-14[.]1[.]0-llvm-18[.]1[.]5-mingw-w64ucrt-11[.]0[.]1-r1[.]zip

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/06/2024, 00:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/brechtsanders/winlibs_mingw/releases/download/14.1.0posix-18.1.5-11.0.1-ucrt-r1/winlibs-x86_64-posix-seh-gcc-14.1.0-llvm-18.1.5-mingw-w64ucrt-11.0.1-r1.zip
Sample240607-a8rbfsfg44

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1972	msedge.exe
1972	msedge.exe
2868	msedge.exe
2868	msedge.exe
5108	identity_helper.exe
5108	identity_helper.exe
1648	msedge.exe
1648	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe
3316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 4748	2868	msedge.exe	84
PID 2868 wrote to memory of 4748	2868	msedge.exe	84
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1912	2868	msedge.exe	87
PID 2868 wrote to memory of 1972	2868	msedge.exe	88
PID 2868 wrote to memory of 1972	2868	msedge.exe	88
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89
PID 2868 wrote to memory of 1952	2868	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/brechtsanders/winlibs_mingw/releases/download/14.1.0posix-18.1.5-11.0.1-ucrt-r1/winlibs-x86_64-posix-seh-gcc-14.1.0-llvm-18.1.5-mingw-w64ucrt-11.0.1-r1.zip
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3748 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,18381022907485034747,13496392400273103625,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5856 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4892

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:4828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 335B
SHA256 e4e96ae4bd1f7681e301bc483bfe118b5e74d731a80530e9593658e8abf4f078
MD5 83c196b5604385bdab9561002a46113b
SHA1 b6f617a1d944119828c429e36a0542fe82ee79af
SHA512 79d643f4ef121d0d8a09aff8182337a0d953b14a6d2ecdf1359304b0c15d94cde430c90458d47ebcb7a5c260d88576c6983b8279963f47531d8c8de075171265
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0e1c3e862133c9daab1e8242ab3d4577ecac82ff27aae5de93493d677813f0b7
MD5 6057f01fd9a97e64850d943980562911
SHA1 89da685d1852f915eadb1f546c885dc4ce270926
SHA512 05eab6514fb4d0cafdd4d8aae9fcf8e5533e88ba62d839367f41d8122cdf28c8b195f3d737ff373d8f6546c51a6505b29a63a1fad52f18e3c6fa9f52890e98ae
SSDEEP 96:nhkCh1n3e8wpvWMoiVmdeHpw8EjAZbUWQyV+VD7ziEwb:nhkW13e8GWMXpwuZbrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d7478b3ef735eaa23aba3a6e83997390d1b392e8e516b990d13c1ef6988786e3
MD5 1d8a420079fa6b05f0d75bb2b0ed5add
SHA1 ddeaf1203aef165f8134d5fbb80bca95c75ed0f4
SHA512 ec0486d0d05e02f968c65634d2888a3e2ca9193eeeb3be88afb1788aaa8d1f95f89d78cdb7320e624957cee239a17a8d4458c0f88adf555cba42b5307f72d21c
SSDEEP 96:nhk8sQLh1n3e8wpvWMoiVmdeHpw8EjAZbUWQyV+VD7AiEwb:nhk013e8GWMXpwuZbrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 48b3552f8ef95fa08b6a191e1ce8b92a1693cdd0ecc82d66ff859efa156987d6
MD5 90e993de683679e2a3e6d6ef07e14041
SHA1 cdc25ad2695f651957fe22d60658cf7d92b321b5
SHA512 95021cc491fce9f2da9b28bc9ad1462271ad4c161b2ce8cdab9f0cd2cab3a65c52c6a63b0a6d0f0fe479ca5b4906bce4e50f4b0718650043eefe8f1ae6bc56a4
SSDEEP 96:nhkmsQJVh1n3e8wpvWMoiVmdeHpw8EjAZbUWQyV+VD7AiEwb:nhkyz13e8GWMXpwuZbrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f4c7d75c8fcc32efbaca6e64eb54ab40e5c7129cbba27e1b55696b556971850f
MD5 dc27b833335bff0bb6fd9a1f248658ac
SHA1 8b16a8f8ba4b1afefc9a97d013c939b93ef97ea4
SHA512 addce2765c2eca6e5e84a6f815b50ece495c44bb19b2120460a3add962fbbee2b9b6e186b94e673819db7b7c36ef4253e648f229def680afcaed6d0a6d0135be
SSDEEP 384:69iIxuERzA83h09RZxYztPM540QEFaOMWRHqlWv:ZIxuERzA83h09RZxUM54pEFXRKo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 286bad38d90afa28f59592a2a68fd38772ece3b5abee8726509b1c8e34999d87
MD5 24df124ed0fe0eb95c84dee6e9af058b
SHA1 20dd903642cacc899b458e0f5afacb90372a5ece
SHA512 80e513e6c0ec1f7a3bac1e9162c0bfe13b388e224b1950ddb4cda5b91858a990c559775fea225e29319ffe79cfd68b0a6d72d4f2894839baff6df4f2deca34b5
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupB7Mae2RUle/J+kEZ3z2OMM:A9iIxuERzA83h09RZxYntxEZaOMWRHqo
MD5 SHA1 SHA512 SSDEEP

Submit Download