hxxps://f1c3b35c[.]nedewa4262[.]workers[.]dev/?qrc=kent[.]sundberg@volvo[.]com

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
16/10/2023, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://f1c3b35c.nedewa4262.workers.dev/[email protected]
Sample231016-p8a2ssfa2s

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2760	msedge.exe
2760	msedge.exe
656	msedge.exe
656	msedge.exe
2016	identity_helper.exe
2016	identity_helper.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe
972	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe
656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 656 wrote to memory of 2836	656	msedge.exe	81
PID 656 wrote to memory of 2836	656	msedge.exe	81
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 1616	656	msedge.exe	84
PID 656 wrote to memory of 2760	656	msedge.exe	83
PID 656 wrote to memory of 2760	656	msedge.exe	83
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85
PID 656 wrote to memory of 4824	656	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://f1c3b35c.nedewa4262.workers.dev/[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaf93146f8,0x7ffaf9314708,0x7ffaf9314718
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5948 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11345137110392635600,13847527405048082566,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 43e50edafcaaeae9fcd4dce5b99bf14fe79dae1401019443f31aa9ff81347764
MD5 3d5af55f794f9a10c5943d2f80dde5c5
SHA1 5252adf87d6bd769f2c39b9e8eba77b087a0160d
SHA512 2e2e09a00db732ff934da1e6ab8617fb3c8de482f9667a2c987435d0a5d67550b4bfd66e8b4475012b60908c24e39dff58e2f2ffa55f13ffc55caae1be630c71
MD5 SHA1 SHA512

Submit Download

3ba8b20d-6d20-4117-990d-24db1e5ddbac.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3ba8b20d-6d20-4117-990d-24db1e5ddbac.tmp
Size 703B
SHA256 68b17dd4c4e936e7d42add16ee6d91d328a5e377038150a5da93faa3c97b5628
MD5 d94fec065e1318b05403fe24d526a81b
SHA1 2df4b7bc89f5e901093879788c308f202adf406b
SHA512 79ec265785df14f4e29b8e591c67625eccc334df8f9c33e6cce736edb294c1ce605f82415836124d6df97f4dfeef90c65db02f2c36b53e7a41ef1d4de348eda6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 03083269108a6bf2e8e39a72205fa4324be0c5235cdecad4935124aa7d29b7b5
MD5 2d362351d93e3e4b4b0661316e07dade
SHA1 b94ef9066f9fef482f6666e26d1ee9a813bb4afb
SHA512 233db912a66e5a87e90cb743568263e27899a7019633bcf24ad237f2f6503f5d1d9a8f2381940f51aee83df8371200b0ea3f35e95cda1aed6184bc7e6cb892a1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 a1bfbdd76a3dacea5f9bed19ecea293b81fc59c9315b470d1a27b44f6ab563d2
MD5 0bd062091fe2c27c32cba4802dc89ed8
SHA1 f2f028109d2387185531933326b6597ebe661294
SHA512 ff0035ff5733e9af2af948bd1fb3c4753c558c2b6b617727c7fd4dda844c9a746a2e5a2d345350aaa2b8afbd19c4a24ce1db65746a3cdced43913ebc1515611f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 24c50f23dffb2411de78c28e582d9829d827d0ffa71f6649a7089744c00448ea
MD5 d3d4a6e09da551cede7476b87e88eb2c
SHA1 c860e3a92722b6be84a8ca9c96808e6670542a48
SHA512 797bdaad66ba65ec688443f42b080d608130a82a14cb8a647361a959d5870fd782687f84a65922070b643bbac6a243034b705c0b02dacc2f4cc7ef3d07681a67
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 54bc71aef109a009ae4281095255c30f5276ad9a3bb092d64d595cba18ff7920
MD5 1c45635d56c3332f49f5c3b05382f76e
SHA1 481739a56953833e1694bd6b5ad2c17eded65319
SHA512 16bbf28e8899ed516c0f3693d5c1e6dfe3e179b7c53e2a6d834bec4f805679ab09795a3913d1bc8cd6acc447b4bac510b29742614db03af5ac996b24e17640b4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 fa277e96ac6d8686e848d57eac2a8fb3108f05a2c6da3b8305370fabe86743a5
MD5 d04fd5b4c63884d84f27add01d5cf377
SHA1 878a6d98321e4e74833b6cd337fef1caf75bad76
SHA512 5826e4f531fef7ad4b813e06796e30ac26be660585e2f4c79e2291db3f914a0c733b5dbcf043433d7b0f78dee9950d99d9caa6928b4ed252089061ca054b0690
SSDEEP 96:nikKP1FCOrKwpvWMoiVmdeau21j5hvxUWQyV+VD7AiEwb:nikUXC6KGWMKu2hPxrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 af598306fb986d1a80ab73cdb8928a0d7a7e80d896f5f0f99a5d809dcd40670d
MD5 24d3779a70d59dde9bebd8617fbc8615
SHA1 b24098ea74ee605710231803bf711a792309382d
SHA512 a25ec40250125398827a999de7e2000410afa26bdb2d5d3d8167a51a28319a50ad011fe91c087f64b0fb903fee38a80af0a6bb62d198c26f6848748c6302d633
SSDEEP 96:nikF8P1NCOrKwpvWMoipR5mdeau218sfdj25aL8xUWQyV+VD7AiEwb:nikY7C6KGWMpku2ysf12c8xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4d4d26977eeb3aa6e03929e5c0f4a1acf9d09c90de4ada3869025209769f9a76
MD5 6cd6dd9b74b527745225a52d88531a28
SHA1 d4eaf01c19f6632332817a0e1250857ec5d5a794
SHA512 88671f77cab73c0058f31da9d208e587682433ec8e0011c0c8ed3ca17f956778f40b033b2a9fd0795139bbbfd331107cb52e85e19dd45a3c5ae2ff7e58d3f849
SSDEEP 96:nIkGP1FSOrKwpvWMoiVmdeH5mxUWQyV+VDCzia:nIkYXS6KGWMXAxrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c9125121eccf1f2f7f6497e75c3b5aea5386c3892cabd359ee6de314703b2dbd
MD5 68d3b79542957bf89ee6ba1980a48bb7
SHA1 00a13eb82ce94c7312fa20148195515aeffaad52
SHA512 ec3358aa07e88ec510a06ce29134ee546246c12e15ec9e31c5a2a38bdaf4b308ba499d091cd29e1da3c83dbdfe715b89716e154d8dcaa31ee646226e8c3d86dd
SSDEEP 96:nikMVP1NCOrKwpvWMoipR5mdeau21d25hvxUWQyV+VD7AiEwb:nik87C6KGWMpku2r2Pxrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 d818b1cebb2d1e2b269f2e41654702a0df261e63ba2a479f34b75563265ee46b
MD5 10f5b64000466c1e6da25fb5a0115924
SHA1 cb253bacf2b087c4040eb3c6a192924234f68639
SHA512 8a8d230594d6fade63ecd63ba60985a7ccd1353de8d0a119543985bf182fdbb45f38ccc96441c24f0792ea1c449de69563c38348c2bedb2845522a2f83a149db
SSDEEP 768:nvUWZN8F1+UoAYDCx9Tuqh0VfUC9xbog/OVTLlqIrUmhlafz:nvUWZNu1jaOLcmhlafz
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe58eaf7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58eaf7.TMP
Size 701B
SHA256 163e7eb6004dc8fc1efe25cc50b3a885a0353ca374b60cf93e4dc3a0ced759f0
MD5 57b4f10e142597c658e21925e72b2b3a
SHA1 48ecc5081252a6913972ac72dedc82d7529bfd92
SHA512 d3752332bba637d32f443f71068d716964e1bc3970cf653cf684ef544a14f8f771743807a47ebfcadb979be46f727190d147c5d50e90ddc7f521c658247177ba
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9af37985a3292c6ccd607b663261d5df41a2cd1c34e673276edf41796704c074
MD5 1c5c228af7b2da8a712409a29e7786aa
SHA1 1b1711e43b20b42ed47b873632e606f0287749f4
SHA512 d8aa0f5999604ba0b51832e0b2f12627144679a793c9ac86ee2dfddf723f97c7feced9b0e1e66422d4d3dc2fd7796533fd3892aa7fa692fb8476654e79fe4a4d
SSDEEP 192:KoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZRW/e2RUzQwbxN9g+N58yD:O9iIxuERzA83h09RZxYDWHCN9gSmfhrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 9bb4cad560946e64dd3436a7e37940ec09ebbb024d8bec31741d632d04146ccd
MD5 10fe2597aef3d13fac028440ed3e0b0a
SHA1 fd94065b333fc86f91b5cf3f5a0b4faf05c3cf54
SHA512 72b738af2ef09acc03567f39e4d6b9ac1ace44ba740b6cacfe126bb484b547251157be1f1ef2664dc7cec2bbc4fe58264edd3adcf415848ecad940b66b769e2f
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZRW/e2RUzQwbxW9g+N58yD:A9iIxuERzA83h09RZxYDWHCW9gSmfhrW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2047fa7e21355594e8fd89453d1dfd33f8abf004587c090bc2436445a08a6c3b
MD5 2889e16e36b9d922334c361f4fd13029
SHA1 0a98ed3c378a87f575373796d1795265b17c1e51
SHA512 a6546487db29d94eb4824a160909ce372f8fd89eb9e13abae49bc8c76c2e3284ce4d64399ce6dd780362e748b7ca0e31f5718acf00480b5608b5606cd64a6056
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupZRWoe2RUzJ9vbwbxT9g+NZ:M9iIxuERzA83h09RZxYDWGO9QT9gSmfo
MD5 SHA1 SHA512 SSDEEP

Submit Download