fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240730-en
resource tags

arch:x64arch:x86image:win10v2004-20240730-enlocale:en-usos:windows10-2004-x64system
submitted
02/08/2024, 01:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84.exe
Size 190KB
Sample240802-bxc55axeqr
SHA256 fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84
MD5 c2f683d0e30696e145b51cd59844678a
SHA1 32c9ccf9ae8ea95e6340fb8bd93d22d6b80bd2cf
SHA512 d6b34453d049fd748b51a9591c4ba42a65db770d0fce525971ef5eb6e31be91ac8c3c02cdf1f9c583abd772ced5162c1eae189abda6e6d83c3fa2027e0113b6e
SSDEEP 3072:cgT7pgdEuDHP3wo5Dkd+Mc1A8sTQuqsdNXcx/Gkhgb:cgqquDfVk8InEt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4424	msedge.exe
4424	msedge.exe
2328	msedge.exe
2328	msedge.exe
4416	identity_helper.exe
4416	identity_helper.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe
2328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 2328	3212	fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84.exe	87
PID 3212 wrote to memory of 2328	3212	fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84.exe	87
PID 2328 wrote to memory of 1448	2328	msedge.exe	88
PID 2328 wrote to memory of 1448	2328	msedge.exe	88
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 2460	2328	msedge.exe	89
PID 2328 wrote to memory of 4424	2328	msedge.exe	90
PID 2328 wrote to memory of 4424	2328	msedge.exe	90
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91
PID 2328 wrote to memory of 4928	2328	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84.exe
"C:\Users\Admin\AppData\Local\Temp\fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2328
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbce646f8,0x7fffbce64708,0x7fffbce64718
    3⤵
    PID:1448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
    3⤵
    PID:2460
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
    3⤵
    PID:4928
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1500 /prefetch:1
    3⤵
    PID:3472
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
    3⤵
    PID:3028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
    3⤵
    PID:4684
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    PID:3488
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5144 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
    3⤵
    PID:4668
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
    3⤵
    PID:1560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
    3⤵
    PID:1836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:4716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:2868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2918594103837893215,5630378691423379304,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3556 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=fb909b641238c13c8ae25b695513752cd1f601ea3af71d073fdf951f70004e84.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffbce646f8,0x7fffbce64708,0x7fffbce64718
    3⤵
    PID:1732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4180

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0fadf52a-644d-4bc2-b95c-6c05d59546b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0fadf52a-644d-4bc2-b95c-6c05d59546b1.tmp
Size 10KB
SHA256 539f087aa40de64b114c5c4f110bbc0cab0942b144802a89bc95388bb58e444d
MD5 dc0be84306e21f54e8c46bda32fb491f
SHA1 4930a9593a6e869c953062b46ae27f795e6207bd
SHA512 c204f82a05a46b88ef92b4e4b0deb5c85ead561694a494d42cf09e78c191f1762b63f087bb3f3e01c5d2a9daced6a94287d1e396e5aee60211c11268a7f22c4f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup3e7Re2RUY3FZs0KVhY3+MP:A9iIxuERzA83h09RZxY3oFb9Ko3+MP
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ff9aa521bb8c638f0703a5405919a7c195d42998bedc8e2000e67c97c9dbc39f
MD5 54a5c07b53c4009779045b54c5fa2f4c
SHA1 efa045dbe55278511fcf72160b6dc1ff61ac85a0
SHA512 0276c6f10bb7f7c3da16d7226b4c7a2ab96744f106d3fea448faf6b52c05880fe65780683df75cca621e3b6fff0bd04defb395035a6c4024bb359c17e32be493
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1f74c3d5f4d41c4d5358e63ad09f8cede236eb66957f9888f42abf98b238c086
MD5 d3901cd618f65d66fb0643258e3ef906
SHA1 c9b42868c9119173ff2b1f871eeef5fa487c04f6
SHA512 89c122ea72ae3f26c94e34040e0f0a856506c8490ba36fce371a731b3f0588407c6356cca2ebea37ac829a67c2b398e298a64d5a72712172f69071264ca58e98
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 08c3c1fcff51df6c1de5f556896c502d2b65cdfa865eda257373264a1242a162
MD5 8d6bc84b6ee8471e9483261149652644
SHA1 0a140cd8baae747f087a965792ed0d4bda25b38a
SHA512 34cdd56c1179ac388e602c6f889f80faf464bf0f0e066c6e77b5d87ec6004d2ba3a4516f68bff196275e34119bc59131d5fce1c73128cd632c9329ce4f6af206
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e0acb6850b20e9b597a6492613d7a619d0631935dfae5a0a273dde1476371aba
MD5 c70d42895e170231097ca895f771bc6b
SHA1 37908103bf77f0ab6a4570d60de0de601c607542
SHA512 26dedebcd722f6ca0acca9d5af1bdd7b19bffc628bf6c62a01fc16ac853fcd49648f68f7ad1f11f27df1958ea76bec0eb33b87be746810b6f16517e0fa28f495
SSDEEP 96:nxk4xm/GQYmq41eozYwpvWMoiVmdeHbj8/+sUWQyV+VDCziEwb:nxk5fTsokGWMX5sro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d084c3cf7ff62314933670f1410131273d0797fa5295490ee4df6b685f692c0a
MD5 5c07ed44657011427fa380a98a638aa9
SHA1 50af975e4d0e1552a7408dfcc4487a9f6ca5a35d
SHA512 9c486a908b85c2d2f6e4dc12c8fc2162958e9fd84736468e9f9d5073b8873f36997df6db258586d060f6e21d3373cf048550fa54e2193b205c41e4951da6e62d
SSDEEP 96:nxk4xm/G6mq41esoYwpvWMoiVmde1HYkMkdf8pwjn/+XUWQyV+VD7AiEwb:nxk5uTssRGWM9YkB0nXrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0e011d49c8589d8fc64f6a484c9bbda08519f6d81e73fa1910a5f919134f7404
MD5 b9ffd95c5e4df58cb309b42645e78273
SHA1 95b24e9e3c284a88bc060a0a941fc14e76ef8a7c
SHA512 74e92868c6c05716e3497e76661f496b03c4d925b844a430e931784c2536ec402ceb8c37f09f5cba1d77303b975a7b0cb75580443f0ba310cca2499e174be607
SSDEEP 96:nxk4xm/G6mq41eoDYwpvWMoiVmde18uU1jbjM/+sUWQyV+VD7AiEwb:nxk5uTso0GWMOuUhpsrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 7e7d12d64b99603954d52104e5a02c3ac1f37d66574771f40bd3bc575d96f616
MD5 061dbae91147a3901c738b3bf91a5ae8
SHA1 399bb584c89eadca4cce974cd9bcf14c8a416ea1
SHA512 edb3f440f2a47c73d79607ae6f1a6617b85be600cdd59bc1b0e463289a13eae610c4cb53c129ed29d971726965bb6a91bd718afd98129e8995954842c92147b9
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58054a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58054a.TMP
Size 371B
SHA256 c7098e130643b80d9633c9856d3af7c918d2b3274788065ecb23b5e08082e4d6
MD5 b28ee57594edee947fb51d9f5677aa31
SHA1 217a8f1c60075932f5fee419a7bafe1a77b68421
SHA512 bcd961a694ad17145422d1bb348a072fb9bee751250a4ce068a054a1ecb9b30582b2d10dfa7d4d33030326ad7c074cdd6b4e120f172f3b7a64b393bc89e2a6a7
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download