hxxps://dp-sales[.]lt[.]emlnk[.]com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItNWI2NjRkMWVlMTU5NDUzMzljNDI5YjZlZDQwYzcyNmUucjIuZGV2JTJGY29udGFjdC5odG1s&sig=Ez6x8GyWzWKtq67fwiJzEre2Rwf1NUitBjWfCvUbPj2w&iat=1695779016&a=%7C%7C254922179%7C%7C&account=dp-sales%2Eactivehosted%2Ecom&email=S%2BOe362kUpSCbXxxsKWSRtUf7ujNFRLSmJ2UriOPwDIBVWNT8A%3D%3D%3AYo2TmrtXjn1rBLhWKMOgtFyWm6oGaK2l&s=9829c3e1ba63619eab00cee0c6ceea8e&i=1A3A1A5#test@test[.]edu[.]au

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
27/09/2023, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dp-sales.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItNWI2NjRkMWVlMTU5NDUzMzljNDI5YjZlZDQwYzcyNmUucjIuZGV2JTJGY29udGFjdC5odG1s&sig=Ez6x8GyWzWKtq67fwiJzEre2Rwf1NUitBjWfCvUbPj2w&iat=1695779016&a=%7C%7C254922179%7C%7C&account=dp-sales%2Eactivehosted%2Ecom&email=S%2BOe362kUpSCbXxxsKWSRtUf7ujNFRLSmJ2UriOPwDIBVWNT8A%3D%3D%3AYo2TmrtXjn1rBLhWKMOgtFyWm6oGaK2l&s=9829c3e1ba63619eab00cee0c6ceea8e&i=1A3A1A5#[email protected]
Sample230927-e71kysff9z

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
2620	msedge.exe
2620	msedge.exe
3492	identity_helper.exe
3492	identity_helper.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe
3328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe
1600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 1304	1600	msedge.exe	49
PID 1600 wrote to memory of 1304	1600	msedge.exe	49
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 3872	1600	msedge.exe	87
PID 1600 wrote to memory of 2620	1600	msedge.exe	88
PID 1600 wrote to memory of 2620	1600	msedge.exe	88
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89
PID 1600 wrote to memory of 4164	1600	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dp-sales.lt.emlnk.com/Prod/link-tracker?notrack=1&redirectUrl=aHR0cHMlM0ElMkYlMkZwdWItNWI2NjRkMWVlMTU5NDUzMzljNDI5YjZlZDQwYzcyNmUucjIuZGV2JTJGY29udGFjdC5odG1s&sig=Ez6x8GyWzWKtq67fwiJzEre2Rwf1NUitBjWfCvUbPj2w&iat=1695779016&a=%7C%7C254922179%7C%7C&account=dp-sales%2Eactivehosted%2Ecom&email=S%2BOe362kUpSCbXxxsKWSRtUf7ujNFRLSmJ2UriOPwDIBVWNT8A%3D%3D%3AYo2TmrtXjn1rBLhWKMOgtFyWm6oGaK2l&s=9829c3e1ba63619eab00cee0c6ceea8e&i=1A3A1A5#[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a6b646f8,0x7ff9a6b64708,0x7ff9a6b64718
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5256 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4888 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,17422240913691347981,13280313237217944945,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3328

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c
MD5 3d8f4eadb68a3e3d1bf2fa3006af5510
SHA1 d5d8239ec8a3bf5dadf52360350251d90d9e0142
SHA512 554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554
MD5 SHA1 SHA512

Submit Download

59ebaba5-6584-49b2-b003-98387e1f4735.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\59ebaba5-6584-49b2-b003-98387e1f4735.tmp
Size 5KB
SHA256 02a9d4dd1d1775a447cfcf5fad122d01c086270d3fa53959f78606fb5d8c81ca
MD5 35966d2dae7952a2af0f9582e1905a7f
SHA1 ff1ec28b53889c37440b8273b4a6d94285b2f2fe
SHA512 959e020fcfc37e6c3f0c1c8de5f87a855bec1b9c93d43aa764a08e623c9c4d86dfb341e8bc96f67739ca012638ee17a8431c7da748453af936fbed60089ab75c
SSDEEP 96:nokIYgm/Ntmq+1HgwpvWMoiVmde81uN1jW4LUWQyV+VD7AiEwb:nokRWxpgGWMs1uNh1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 192B
SHA256 a6356fb54693e9ba6de0b4d9146ea862a564b1e36421dc03ff2f5169b03be4b9
MD5 d24f58af275f17ca6540044f4edb3b6c
SHA1 2aa4ecba618f7b3b23e70f7004a0d75344f79a49
SHA512 55e865462a0df93283eb5db962a388051b25cd0d833366eff5848a45e4b76622837c9f1e5ec235b1ef3d267a2326ae446f22a65697864763b9ff09bc776dad2e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 926B
SHA256 33682e70b2d4ed93ce09b9bb889eefb01e26d61d3e6184bf099fe5eaca4143b7
MD5 f354c2dcc6a008010fbe1523d5934c79
SHA1 c26d5955f75f6af457465f07dceee5c6120680c3
SHA512 75813514de1322740875d9b850230e0dc93da10455f86ab646e6362f96ca61f62e800ee11a596f442027eb8199f18add202f353b14cfbe14b31ecc8045787f7b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1df47bc517e89f55ea250a75ca15dc97b975502e636e522d4c571936e16a8a43
MD5 5a2e7d419ea09d1ddbe0aa84e87b5a7d
SHA1 93dd3c8787107ec7be41c128d3b2faad9bb1669a
SHA512 e5a98fa3b260b47dc4aad74f6fe6a10a928902aa21a65630cde076daee2335689f3846d84e326beb5726034d479ffb272705f022d5c5ce91b3435447e8fde469
SSDEEP 96:nukIYgm/NQYmq+1HgwpvWMoiVmdeHWFLUWQyV+VDCzia:nukRWxpgGWMXUrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf
MD5 d985875547ce8936a14b00d1e571365f
SHA1 040d8e5bd318357941fca03b49f66a1470824cb3
SHA512 ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38
SSDEEP 768:nMIWzY8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJLlFprUHfgxo:nMIWzYu1jakL6X
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 b8041316ebea01de92c22ed316f50130e6c7cd2646f332b870750739b4fe4295
MD5 32577973ba6ccefb4b2452326d18cf38
SHA1 2949c0f1128f35275d83efe2c4e008ccd6a4ce0e
SHA512 5e9ab6b15e71f0848eb9742a93f85e89a341c9303327fbc83ab7c3ca933c3a1c218d4d7385574cbe32990cdc6c0739032cfd8ea68552792c56d4d70aa30c8099
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoFe2RUkYOb2PxPDNem/i5u:N9iIxuERzA83h09RZxYmSPJDNH/i5fW
MD5 SHA1 SHA512 SSDEEP

Submit Download