447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101

Analysis

max time kernel
144s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe
Size 38.6MB
Sample240609-bga1tsbb8z
SHA256 447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101
MD5 2e75d3c7e817581b378bbcc75082281b
SHA1 5b45e7eb54287486ae76768a20d46087204d95e7
SHA512 16d2b42d8f6a0076129b8a6cb71b0a7c09f31d834b598e7790584bdad743b772f2d7cbbd61e8726ff6bd6f5f0f52009c5542922cfd50fd6af544a346d9218215
SSDEEP 786432:8Kn6iTfRwFOUPofAl2jtyGIdcDxvVEyaPZP:Tf2VP9l20GMcD1kP
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

Malware Config

Signatures

Downloads MZ/PE file
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 506985.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3680	msedge.exe
3680	msedge.exe
4672	msedge.exe
4672	msedge.exe
5060	identity_helper.exe
5060	identity_helper.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe
5032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4848 wrote to memory of 4672	4848	447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe	90
PID 4848 wrote to memory of 4672	4848	447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe	90
PID 4672 wrote to memory of 5040	4672	msedge.exe	91
PID 4672 wrote to memory of 5040	4672	msedge.exe	91
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 4928	4672	msedge.exe	93
PID 4672 wrote to memory of 3680	4672	msedge.exe	94
PID 4672 wrote to memory of 3680	4672	msedge.exe	94
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95
PID 4672 wrote to memory of 2768	4672	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe
"C:\Users\Admin\AppData\Local\Temp\447b7be51ab6156722c4f87d5d76c7f9dcc2eea6906e2c4a79ecbe6afdb55101.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aka.ms/dotnet-core-applaunch?missing_runtime=true&arch=x86&rid=win10-x86&apphost_version=7.0.10&gui=true
  2⤵
  - Enumerates system info in registry
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8b12646f8,0x7ff8b1264708,0x7ff8b1264718
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
    3⤵
    PID:4832
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:4152
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4656 /prefetch:1
    3⤵
    PID:1912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5152 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:4596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilReadIcon --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=icon_reader --mojo-platform-channel-handle=5604 /prefetch:8
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
    3⤵
    PID:2372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
    3⤵
    PID:1020
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 /prefetch:8
    3⤵
    PID:2168
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6464 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
    3⤵
    PID:4700
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
    3⤵
    PID:3796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,15832073359926242035,11466798678589072408,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4708 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:5032

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 4e3eb0ac9303ebaf7b3466f34432fbace889223d630edf396665f96cb1755230
MD5 7fad69d675a815e0ea4fc90433d7b672
SHA1 1cbd7bbb04a00f9809a0a50ea1f8df2bb3909e32
SHA512 9fffba9b3602ba6d84e5c3659f720e7a306f46b06a9cd7bac34ee9d1e0b43bb55d7617c924b380c8603c3af38ff394a5a22c9475c4c06f6498022baea0ab1258
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1002B
SHA256 781d02a65958cf1407d0406f0b773ad92edac061b6a27258add0ad1a37c25ba8
MD5 11613da5d58f7e3f1f40b650fd8623e6
SHA1 328689978a55b0c59ab6e150cb908dd9285f21aa
SHA512 6e54f133500951a2ac30c976f8a41b4072fdbbfe617fb063b37367e72d5eeff2a172d545ef4ac5747bdd60e2d1d961c223a8a56cc9181baf23f6be65e308f08d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 09cc66ab2661da312b9f3ddfcadf89fcb943af55063e21d2f9e91e8bcb4ce3b3
MD5 8161a44cf39ca386733ba51c4b08e77c
SHA1 71f4b3ac225e65ca8fdea99aa4a22d1d67064e67
SHA512 d79e13314191e9c9ebc7d10ed0377f78ec62515f3f9af8925f39a8665271921f19fa71b0007b3106bf2b73da9a2024613678e7f98a0a5c02b93389742e0f016d
SSDEEP 96:nlk8sQ+K118juwpvWMoiVmdezCYu/S1jvSL3tUWQyV+VD7AiEwb:nlkMH8juGWM2Yuqh69rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9dbe3d956333ea6eaf3785bdeef48e8eddbeab255705faa400403e07f423f119
MD5 b0a7c9e8516454121a730c9f27373f38
SHA1 97d226e986873763f7b138a415ed942e36a073f9
SHA512 ecff4c652032e35863753d84283bbd17c0fedbfb582b078fd13f6917ab9e6b30d02cb40adb88f0cbca007d081539a612748af76357608570d20a6c5e65c9dd53
SSDEEP 96:nlkhK118juwpvWMoiVmdeHvSStUWQyV+VDCziEwb:nlkoH8juGWMXXro
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 703B
SHA256 61b0238368633088309d47d843611235b7f3cc88105657239fecbd4859a88978
MD5 440e710111c9fd5ef2e414028f3e1402
SHA1 e33f8abce6cea73b73fec3e9ae9a7d3f7f37a21a
SHA512 fc645e1c567b4b36de293543de98f0503442fa7c532aa639991abacfe646fadc96def6926ad196155d59d36493f06359e3effc9e566e271e4b5117f508df2ebe
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 703B
SHA256 c3f32772aaaa9dc8a8d01c0143bdb3c249c77b0ce8665cecc8c32fab6af19895
MD5 4e9e3d8236c26e5b3775430e638dca07
SHA1 65484a54daebe1a390e57762d897651ad831560d
SHA512 f2d036eadafd564488926b28d0b7f328b3445c4643a6e3422367b4ecd8d16123b16a779594a2b3afdd70e561d8412d646de2ed86442921d1a6f2d453f533ea5d
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5886af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5886af.TMP
Size 535B
SHA256 77c1bd2fe666b630d5fc958ead86c2fbabeaf4e57db35ad37116ec21976238d3
MD5 d31f74b60f1d7b68486ea1b5a1278a01
SHA1 132de003846de31ff7feeef9f99bbf1143d7d913
SHA512 559a36d63335279fd9e3dc5843b47ac01b3a889eb8fa6c57e0c7b87ce2eaa948fbc4348bef18c755faa95589cdd4f9e0d231234a514f2ffb5e81004cf6f81494
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 39b9d09bcf012dcfcc5e0f918d3cda9ebb531baf225c4e141fd7090e01e165bd
MD5 92b1a48382a7115dd0f1117f79bb9bb6
SHA1 16b835aedcebc5e31feb9fae808b96dfbc0174de
SHA512 f338f0a542c95cc242295d1ec312edf699bce0dd78decb6e48f764f5ccf1f85d760e798a22235db486b9123c437bdfe832e5152205049fd851ca15bc86abf55a
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupy6e2RU3j4uA3z2OMDCRHqk:A9iIxuERzA83h09RZxYyUU3AaOMWRHqk
MD5 SHA1 SHA512 SSDEEP

Submit Download