2e242e2c1ebdde3d3d41f69872c8efb2ae55850df7f60638769733185d817808

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
17/09/2024, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
COVID 19 GRANT.exe
Size 433KB
Sample240917-pp777atapn
SHA256 2e242e2c1ebdde3d3d41f69872c8efb2ae55850df7f60638769733185d817808
MD5 915a58be3a9c84e3a12042317da2c4e7
SHA1 de1a077b12fce49098ef9d9ba75630b0611eae8b
SHA512 bde6d812e461eca1453c492225499c2730cf0a6270174a3ca6a76c0ae34d7a163e438cf72a8d09e5b86094ca97a712273236758aa3df184b32e24ac88c858cbd
SSDEEP 6144:oaUPSa6VEJD6Lp2dXqm8WmAnjKyDC9nUz1o+yrpjQFNHXhSVnM8:oaU96VEt6Iqm8WPjvGu1o/rpONHQt
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	COVID 19 GRANT.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
3100	msedge.exe
3100	msedge.exe
4968	identity_helper.exe
4968	identity_helper.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe
744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe
3100	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2288 wrote to memory of 3100	2288	COVID 19 GRANT.exe	87
PID 2288 wrote to memory of 3100	2288	COVID 19 GRANT.exe	87
PID 3100 wrote to memory of 1944	3100	msedge.exe	88
PID 3100 wrote to memory of 1944	3100	msedge.exe	88
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 5068	3100	msedge.exe	89
PID 3100 wrote to memory of 712	3100	msedge.exe	90
PID 3100 wrote to memory of 712	3100	msedge.exe	90
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91
PID 3100 wrote to memory of 1100	3100	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\COVID 19 GRANT.exe
"C:\Users\Admin\AppData\Local\Temp\COVID 19 GRANT.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COVID 19 GRANT.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff90e1f46f8,0x7ff90e1f4708,0x7ff90e1f4718
    3⤵
    PID:1944
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
    3⤵
    PID:5068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
    3⤵
    PID:3160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:372
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
    3⤵
    PID:2500
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    PID:4092
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5316 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4968
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
    3⤵
    PID:4104
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
    3⤵
    PID:4860
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
    3⤵
    PID:3560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
    3⤵
    PID:2200
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
    3⤵
    PID:2448
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
    3⤵
    PID:3836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,16899976634516329461,285646057351680440,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4872 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=COVID 19 GRANT.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90e1f46f8,0x7ff90e1f4708,0x7ff90e1f4718
    3⤵
    PID:2468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
MD5 53bc70ecb115bdbabe67620c416fe9b3
SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
MD5 e765f3d75e6b0e4a7119c8b14d47d8da
SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 6fb02f905313e0966a853b8d004ef84322bfb44163781bb38261fbcc43150a45
MD5 b92e5110ea8e47b55ec82dace324be25
SHA1 5c0d068429dd32b403377d434d5c64f5289c31d1
SHA512 35725a0839434b70ab6a963daafea1587ba1b2539f526e2f6449a5514e5fc48578604221e0305e06ea7ff328f65a6dded7c9a59442d7cf242a1a97a02d8300a2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 f8994d689b9e41c9d275ad20466a165284ce453b26d9d561846274934fe2a108
MD5 4c7028f0fff717c83461cfc53dff4a8f
SHA1 54b0a56415c6e89c46404a4a24b09d9684a274ce
SHA512 edc1e6aee7b7b084e8fcd09c34d4e53b88544b54e453465f6fbbe78aa6e43a2c11dd045ab288b146a318454df2ee967f9de5b3e11d0fa523721d51d32edcb315
SSDEEP 96:nJk/0u1ztQwpvWMoiVmdeH85qffMeUWQyV+VDCziEwb:nJk//JtQGWMXjMero
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c9b3b5fb38bbd5ff99ce908bce16c2bb47590460dcf264bcd15141110878fe56
MD5 ce45883a5ea93fbf1af104ac56494dd8
SHA1 ae42fa4585534dc431e7ff73e81311a9ebf659ec
SHA512 8a796f43252da6465baa8d71c9aebe43baae1b99451815d0c57b579c7893831dd946c17f0274c3140c2fa06ca6a5aad6c96e40515ef03a9d49c5466083c96fab
SSDEEP 96:nJk/au1vGQwpvWMoiVmde1QYRMkdfHpJ5mFffMAUWQyV+VD7AiEwb:nJk/xZGQGWMaYRB/IMArg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 fc0787dfa3948f5918ab7f3d2d120a0e21bde12ac4c8ee872e67d211d2856823
MD5 dfb4f6c3a26575d3b0290a67fea3a857
SHA1 ec3e01bc7b24f6029fd6bb0c80d512dc450dcd1c
SHA512 bb067b1ee56392b33c9af7f48ca30d4a37a01f9557f4159e310576b3f772380119098cbb2917b194e72e231c3289255fed028cea194367b800b83a754626bb18
SSDEEP 96:nJk/au1zlQwpvWMoiVmde1yum1j85wffMeUWQyV+VD7AiEwb:nJk/xJlQGWMUumhjMerg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 828ba8b983f301783d8227f055ac309d7537ec3b174e7ab067780ed056476807
MD5 f053de0d2fca1f238bf013852eee8448
SHA1 656da1cc858e9f524b8c7dfa727d170310564947
SHA512 9fea0d0c2ee9fb3cf6417e748c6988d23c1a6fe2fe8ae0a71f359e0796a43fad5f8ed1d171850fc48ab586d34c0f44eca140bb853e9876cf1ee6f54ccf620567
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57f51e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57f51e.TMP
Size 369B
SHA256 d83364f7adaf06c2389bbb061fd1acf2caa6b38ce03fc0611f695dc8791808c4
MD5 82472181e8a4eb2a77ae0660a9b806ec
SHA1 634759f60ad6700f7ad74919463dc6e5c37acaf2
SHA512 88976e79918e876e2961fd4e0cf8d3b24e895483e20e3f6cbf69988adb365e9dfb99dc2a6a7c9b65bf73afbf13dd780cfeb0508ca9e0ab61746e7a58c059e8d4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 6810926b616abf4cfa5d8be49aefcecb66fb4bf79f0cb2c9331473241423dbb6
MD5 42287f04e9d02c39fd6cc404c073814b
SHA1 da43a867ee3aa3065417007f1a26175b915cccd5
SHA512 d5dfa7a49c0f78424c2e9b117a28a14cea2a713128b45e59af15c27dd9ba01cd2d2611623e2ae5b4b5c2323cc226927457b4c30bdd2ae7f425c3dbf59a6592f9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupNRclbe2RUe7i+9IcM/bo5b:A9iIxuERzA83h09RZxYToLHV+qZxT
MD5 SHA1 SHA512 SSDEEP

Submit Download