4542f768e76952b342329aaa8ad61be8cdd7aa7b45bfc7a9ab58a35bc278273a

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
25174E3297AC9587D4F278BFA13F07D225D99844B41B93492F6AC102F867328C.exe
Size 1.1MB
Sample240724-pg6pdsydkd
SHA256 4542f768e76952b342329aaa8ad61be8cdd7aa7b45bfc7a9ab58a35bc278273a
MD5 1da99e77f1a641fbb028b364e2fdf93d
SHA1 22de1eda45d0e7696c2a62c5e571ff5ebe9f5a2d
SHA512 6793c241850b0769384c6e43ccc8ec21d4e4216d8c422e5d9ee4dfff707b694fe50dd7a00158f108e4ed01ecea0f46bcaa86e7182a576459a633e808ee0cb9ab
SSDEEP 12288:t49I/nL8TnKZPVHR3E/bS2vkRNJLXseJQdErvNKj6SKm+eAIhu181d6rsPH:1ngTKZ5RU/xG7zsEyEve6SZ+dIe8usv
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3216	msedge.exe
3216	msedge.exe
4100	msedge.exe
4100	msedge.exe
3336	identity_helper.exe
3336	identity_helper.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe
756	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe
4100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4364 wrote to memory of 4100	4364	25174E3297AC9587D4F278BFA13F07D225D99844B41B93492F6AC102F867328C.exe	92
PID 4364 wrote to memory of 4100	4364	25174E3297AC9587D4F278BFA13F07D225D99844B41B93492F6AC102F867328C.exe	92
PID 4100 wrote to memory of 2164	4100	msedge.exe	93
PID 4100 wrote to memory of 2164	4100	msedge.exe	93
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3444	4100	msedge.exe	95
PID 4100 wrote to memory of 3216	4100	msedge.exe	96
PID 4100 wrote to memory of 3216	4100	msedge.exe	96
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97
PID 4100 wrote to memory of 2316	4100	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\25174E3297AC9587D4F278BFA13F07D225D99844B41B93492F6AC102F867328C.exe
"C:\Users\Admin\AppData\Local\Temp\25174E3297AC9587D4F278BFA13F07D225D99844B41B93492F6AC102F867328C.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=25174E3297AC9587D4F278BFA13F07D225D99844B41B93492F6AC102F867328C.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb494346f8,0x7ffb49434708,0x7ffb49434718
    3⤵
    PID:2164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3096 /prefetch:1
    3⤵
    PID:2316
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
    3⤵
    PID:3880
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=3412 /prefetch:8
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:4600
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
    3⤵
    PID:1496
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
    3⤵
    PID:4460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
    3⤵
    PID:904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
    3⤵
    PID:5112
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
    3⤵
    PID:4740
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,9928685250590212105,8244037164809652389,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2740 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=25174E3297AC9587D4F278BFA13F07D225D99844B41B93492F6AC102F867328C.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:2584
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb494346f8,0x7ffb49434708,0x7ffb49434718
    3⤵
    PID:5088

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2856

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e2d8de6c2323bbb3863ec50843d9b58a22e911fd626d31430658b9ea942cd307
MD5 584971c8ba88c824fd51a05dddb45a98
SHA1 b7c9489b4427652a9cdd754d1c1b6ac4034be421
SHA512 5dbf1a4631a04d1149d8fab2b8e0e43ccd97b7212de43b961b9128a8bf03329164fdeb480154a8ffea5835f28417a7d2b115b8bf8d578d00b13c3682aa5ca726
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 fa6804456884789f4bdf9c3f5a4a8f29e0ededde149c4384072f3d8cc85bcc37
MD5 b28ef7d9f6d74f055cc49876767c886c
SHA1 d6b3267f36c340979f8fc3e012fdd02c468740bf
SHA512 491f893c8f765e5d629bce8dd5067cef4e2ebc558d43bfb05e358bca43e1a66ee1285519bc266fd0ff5b5e09769a56077b62ac55fa8797c1edf6205843356e75
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 19a3929fce70d1e5f5b58cbb2eade69f7a84bd233a091390374eb7473afbaa8b
MD5 8000b57df07c1188da2bb21b90b84652
SHA1 4405937f17e88db04216f1b0251dfdc043bf54d8
SHA512 8ecda2062aa4f6ce64a138c3303863076e6edde7d2b0e1a5c30f41e9d90ff57663ecf87eeff5ce758ed91b351022f9f8f064666cfccaa1005ee3da52facdfd6d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d075e691f2686e23c609b8d32a601b33f66984faa6eba146736aa4bc35e47707
MD5 249445d69b3bd742e86cf051c7ccd483
SHA1 cc685a466ff0c28364dd32a78d0dc93a75916954
SHA512 85dc4013b52cf2930201b2ed3a3adfff52c7119d9408f74d231f774766fac32ecc71d909eeaea02bc40f0322211d9ce387229148a9b9b011dc17811107809bff
SSDEEP 96:nt0kr9L1gJqwpvWMoiVmdeH1JjsUWQyV+VDCziEwb:nGkVeJqGWMXcro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 b93acd6027184b6ae347ee7045bf1c5ea8927eff42a8fac3601e9c9aa2f2dc0b
MD5 b04381dfae34f67ecefbd19024b92e4b
SHA1 2596c7ff8210d0aad4e23a95f747291b9e25f45e
SHA512 f57defe7b6a41a20774f452075b6614652241100c16020212eeffeca5527f881cde82e8fba19cbbcabf931e3c9c6ccc0539c36af16dc2cdd8c1d868c847a7df4
SSDEEP 96:nt0k+9L1UaqwpvWMoiVmde1wqYcMkdf1qp+JKFBUWQyV+VD7AiEwb:nGkKmaqGWMCqYcBtqlDrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c351908ea488721216a90cd36dd82b82c8afc14949e5cb998d83acc6bdf3a6e1
MD5 27ffc14b111a9a48da792778de70f4dd
SHA1 e075dbe759259d493ba67b9a0826c27debca9065
SHA512 3e378248db7efb726c5a5e1cede8db4d19bd2e179729e5f141e48a5fdf0d0d78d8d9250485001b736afb8b4af16ddf6eeebd84c80b5dcfd33b4e93202abab7c7
SSDEEP 96:nt0k+9L1gxqwpvWMoiVmde1JuH1j1JcsUWQyV+VD7AiEwb:nGkKexqGWM3uHhtrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 8ea727e1db5470499c3f6f0e79e76f62b9bbf332c04382cbec836b4530eca415
MD5 29315212d690c9dc426c1b147eb10e79
SHA1 f7c9d51f007c978916da260f16843ce36ad48876
SHA512 9394837ce9eefc4c58574d2dfd87d8d28cd34035cc776e5527946eef0223ceaba8c9596aa843da5ab61bdb0b3d44bb3279626e511c048490a2b24381135a8179
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d4e4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d4e4.TMP
Size 371B
SHA256 1fe6bbfa49226f841c60f853c4fb1a37fff5113ffcde6a86bec1244d98c44687
MD5 c007e73ce555a3aca13b793cbc1dff6c
SHA1 d2889367c127ee7293f1d9c31adaff0277767f7e
SHA512 ce52dc14f85a1600ed46ed6dffbf87d3d969edbff83cc2f3adec5600acee521f69853adb0af965121083c900de666d1f9f641fdde6ce30cb4e12e7025a4872a3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2704df7be5ea61f85084066bc49831f273e48f9e8d9fe506f706479db616dfc2
MD5 5661c0b8cc295ea5aa8e9e53a1a65ec9
SHA1 64083a0ce535d2a1b2ad12fc16f2ed79478c1ab1
SHA512 1d0aacdc9187f9ed8c73528e9c40079236dac4ef539e20de98fc681a12fb5a9d01387b450d52fd78ba80b0f04625e7e4c3ddb95fe3e1617dafcb8ffc1cca1bfc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSW6Ge2RUfpeNkRci9gpCkk:A9iIxuERzA83h09RZxYiINN2cNpCkA8m
MD5 SHA1 SHA512 SSDEEP

Submit Download