8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17/10/2024, 01:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe
Size 17.6MB
Sample241017-bkehestfkb
SHA256 8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4
MD5 f7fefddb5862abe0fbf40142476d159a
SHA1 0ee43653950f32f69f7d824623990b5a505e5821
SHA512 1589e44fca6f3b253f99adb3ba732cf42165fec0bef052583bb27d1c87b7e45c5d7ca702b0ec9374ceb76a6df124ad7d51f5349be0f61e9c1da5e5d99e9ebc23
SSDEEP 393216:q+TCIHS4y0WyNUHKoc8tQsvcsM0wZzRA/Wbo:q+T77yx9Hpc8ast85CW8
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3336	msedge.exe
3336	msedge.exe
2452	msedge.exe
2452	msedge.exe
4364	identity_helper.exe
4364	identity_helper.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe
2452	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2004 wrote to memory of 2452	2004	8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe	90
PID 2004 wrote to memory of 2452	2004	8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe	90
PID 2452 wrote to memory of 3620	2452	msedge.exe	91
PID 2452 wrote to memory of 3620	2452	msedge.exe	91
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 836	2452	msedge.exe	92
PID 2452 wrote to memory of 3336	2452	msedge.exe	93
PID 2452 wrote to memory of 3336	2452	msedge.exe	93
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94
PID 2452 wrote to memory of 2540	2452	msedge.exe	94

C:\Users\Admin\AppData\Local\Temp\8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe
"C:\Users\Admin\AppData\Local\Temp\8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2452
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd502946f8,0x7ffd50294708,0x7ffd50294718
    3⤵
    PID:3620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
    3⤵
    PID:836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3336
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
    3⤵
    PID:2540
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
    3⤵
    PID:3940
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
    3⤵
    PID:1060
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    PID:640
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5136 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
    3⤵
    PID:4300
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
    3⤵
    PID:4348
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
    3⤵
    PID:1624
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
    3⤵
    PID:3964
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
    3⤵
    PID:1596
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,14667696163679906099,13808154418885942793,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1972 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=8be672e2d623d6030b6420c3583ee0d98d7ab30f1126da69e0bf8d337e9e33a4.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:216
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd502946f8,0x7ffd50294708,0x7ffd50294718
    3⤵
    PID:796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151
MD5 0a9dc42e4013fc47438e96d24beb8eff
SHA1 806ab26d7eae031a58484188a7eb1adab06457fc
SHA512 868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e
MD5 61cef8e38cd95bf003f5fdd1dc37dae1
SHA1 11f2f79ecb349344c143eea9a0fed41891a3467f
SHA512 6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 d1c2417ee42008373644123434d8f4287ec4c4ba9509953a388aa4502c7b180e
MD5 d842a2f1d9944ae0304a85453dac5979
SHA1 8488ce593931cf0b0e8c37be21f671d28ec851fa
SHA512 c46ea68da4ce0b7fbe2019f873e8d3dc065181bf84ba9ec2573d152faf4cc52bfb593f618be03d23bb634915ba1d1570ac4c5cf6999743aa7cec749bb710541d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3c53ecb099c36ba5e63fa7f6a64d51191cc94266988fd703c6920e77d8828473
MD5 4892364ffc46cf4e40bd55de8a43dc9b
SHA1 31f587da4ae1cbe1b5b10b7ea794d57cc4f55aad
SHA512 7a5e68ce831d888c3ea24077b2741a76dfbb945745557e307cc40ebdb148c9587199f8cb84dfc99ad400ec979c234594eaaa2400ca287c33569e36531ffe5d5e
SSDEEP 96:nbkirQ1QhwwpvWMoiVmde1MuE1j7CQAZoUWQyV+VD7AiEwb:nbkzShwGWMuuEh4Zorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 636be4b37d02fccb13844d2f315c81abc7188d1b53ad0b5d1ac55ba7e710509d
MD5 136c1bfa06e00eff9e72b5c1ef229862
SHA1 dcacefeadd0cb585c7fd5ba496b3597048ae4965
SHA512 cdd8970fcc8e4879c46b177b315ce0ea65dcf5f5ce51412670cc8db1039975dd0ac68ebc2a99f98d0d0affec640aa4aa845b0b43e7bd5932d2d08d2829701d7a
SSDEEP 96:nbk+rQ1QxwwpvWMoiVmdeH7CkAZoUWQyV+VDCziEwb:nbkfSxwGWMXWZoro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 762b209e2946c3960e67aa5c73e8710bf6770b775ce47d01b1e7b050ad4dd00b
MD5 e0fe84da41ed6c2d7d0b1ebf924b1924
SHA1 81b8a4841a7c7e3cc3eb1fccc7f8952af30162b0
SHA512 f339a0814347f0933b94e9d84268fff92d9d39d07bf894eb472527d946889f3e3ae3d1a569ba4b05aacec3c34c312175fe05db62e9709ab11c0adc3a8fbba72f
SSDEEP 96:nbkirQ1kEwwpvWMoiVmde1VYhMkdf+p4C1AZ4UWQyV+VD7AiEwb:nbkzyEwGWM/YhBGgZ4rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 1db01f37152804996e384f8790825655db196fc94de951dd08dee5ebd419ddc7
MD5 584d763e24ced22809f587dc7f1f0be0
SHA1 3bb0c97f6b27567f154b993e4c17f3b0a313c7db
SHA512 1287707850c0d78d589e07ed1c82ddd124985b5c1a14eded70f55847b7df2cfd37e6c207527ea3a5d73fc2144731e9cd033efbb3f68b1e99ad3da12e09c98339
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe583350.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe583350.TMP
Size 371B
SHA256 94e3c576a484212cb6de01089e39ec5b807d2aa99847e524686e86918c4bcf76
MD5 3dfcab3db42885b354cf17ab346be9fa
SHA1 5b0f46aed2f73c6581a86c20ac28e1ba6f701aa7
SHA512 991f07da84eeb76f8effdaff77134a127245f25bf8c8608da4125bd577cca17b6c255562fb59cade8f3bb83f63b1489ef2a15774177959233ad77f7a6cef9024
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6d671ef7403961cacbd0c7b32d028717a9bd00378384ed4ddaef81f7e7f274bc
MD5 3f3b2815f5d4994d9c7f40f4573c7393
SHA1 6122bba36a70480a006c27fb8d5b79c541782008
SHA512 049d730587f04cfc069a968085cd5afb916e75e2dc6c7fb88e836790a69b5d4dbd41c192c7535d99f88213a9c5ac6e61976b5d8c1d05fd26916f923384c4e85d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupV5te2RUXw4nDu1K3wi8C65:A9iIxuERzA83h09RZxYV5p2H+KyC6Mu
MD5 SHA1 SHA512 SSDEEP

Submit Download