hxxps://drive[.]google[.]com/open?id=1i2ZbZle9RAZ4OpLNcFkltfpfXOh-j9KAaP4g107q6xQ&authuser=0

Resubmissions

15/01/2024, 17:23

240115-vx8ftachg210

15/01/2024, 01:06

240115-bghexafdb46

15/01/2024, 01:04

240115-be8jbaedaj6

Analysis

max time kernel
100s
max time network
119s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
15/01/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/open?id=1i2ZbZle9RAZ4OpLNcFkltfpfXOh-j9KAaP4g107q6xQ&authuser=0
Sample240115-bghexafdb4

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
4656	msedge.exe
4656	msedge.exe
1336	identity_helper.exe
1336	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe
4656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4656 wrote to memory of 3732	4656	msedge.exe	15
PID 4656 wrote to memory of 3732	4656	msedge.exe	15
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 3688	4656	msedge.exe	33
PID 4656 wrote to memory of 1828	4656	msedge.exe	32
PID 4656 wrote to memory of 1828	4656	msedge.exe	32
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34
PID 4656 wrote to memory of 4880	4656	msedge.exe	34

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/open?id=1i2ZbZle9RAZ4OpLNcFkltfpfXOh-j9KAaP4g107q6xQ&authuser=0
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xe0,0x108,0x7ffd2f4c46f8,0x7ffd2f4c4708,0x7ffd2f4c4718
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,4841089168966082745,799792244843352637,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5832 /prefetch:2
  2⤵
  PID:5512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 53b34e24e3fbb6a7f473192fc4dec2ae668974494f5636f0359b6ca27d7c65e3
MD5 3e71d66ce903fcba6050e4b99b624fa7
SHA1 139d274762405b422eab698da8cc85f405922de5
SHA512 17e2f1400000dd6c54c8dc067b31bcb0a3111e44a9d2c5c779f484a51ada92d88f5b6e6847270faae8ff881117b7ceaaf8dfe9df427cbb8d9449ceacd0480388
MD5 SHA1 SHA512

Submit Download

7e3a19af-cba8-46b1-ae35-7179178e64e5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7e3a19af-cba8-46b1-ae35-7179178e64e5.tmp
Size 6KB
SHA256 5b0ad6f38c360037e3e507b2c019d64cef47900d51724b49ffd3758c15b12686
MD5 bc61a014c6eeeac380eb692ed2d11389
SHA1 f64ebb5e342f7695050c89d63422113ef2db4240
SHA512 eda750e26a178c59a74205d53bad2eb89f4a34d3f9cb2c7a6faee9610da31e3d3cdcf7c9527581d09eeb17a62f9be31e388d9b6001fe7122b0bd1f6cf14175bc
SSDEEP 96:nNBkMdJ1uOijwpvGJzWMoiVmdeNpKuO1fkqhpRplgcmUWQyV+VD7AiEwb:nbkKYvFJzWMuuOSqIrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 576B
SHA256 72007b33833923cb8982ff349a6fe3e6dc61ddfbd0ae992bc452ee8c620190ec
MD5 114cebf4d444a8c19d7a3be82e86fc13
SHA1 209b6bcf9946c0662efb90615e890e93a6b7e3d9
SHA512 147c54b59e2c07ed22c2142c9888e1a8983ec159c3f466e1f2fcdb2ae497ce84d73140e2458870289806c6953b60e7caeb541ae3cdfe9cd482b406b27fd63a26
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 552B
SHA256 d6df7df26fe642b0d85763a911629d126201aec1bdecd88f0b57d0d016c7c9d6
MD5 6e3d1fe23b137f00614141e9959df19a
SHA1 e148baae1149fb7a85774d4d67582d757836ebfe
SHA512 ab6120f943bddc0df6c797578388e20338ad07750a20bbbde919cb5f685bf383e08a0e1f371d4c2cecb9d612a9c3de526f6625aefb8df18d6244dd829c273f9a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 f27ca360a6868e0e0f4ccdc32c8aece94b217563aa421217d54d51894acb6e3a
MD5 5b590dca51f6fae0fac441f54d3de23a
SHA1 acfc86df72b9eb1def4dfc5ba9d6ba6db0b632ba
SHA512 368aade8ac14052f4197e3ed9946b29ff84ac7292c58c40b071df0a87b786e5497e50a3ae64223765330f84f418ed7ba65f6373498aa0c8c09613955dfc52664
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9df10734f4279683f72f9038359f2a99d9421b7355ba163eb809767bd014874e
MD5 3734c539e354892ca7fc8988c0ce1278
SHA1 9a344a094908bd96a5e8e8bdb2351fe75e65d1ad
SHA512 bea9783cfb2cc4416019821143ee060735baf0a19440c5fb508a96225ef1d76f2fd54ab3b7415cc460c35634c76248c66716ae38cafcd89ff9c24372a8778ff3
SSDEEP 96:nNBk+dJ1W+ijwpvGJzWMoivKKR5mdeNibzMF8kqDif4pRmgcmUWQyV+VD7AiEwb:nbkk8fFJzWMjSbzkq+f0rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2823932c934a300da3c26a48f996e278fe57825d9a77550653eb86559d02f0b5
MD5 1ee7d441c77c810ce6d65a06e6c19ed5
SHA1 1bcaf774743f806f84fb401a7a24c122d112d792
SHA512 f9fd580f30a4820b5d28501cae21671781c9ffcde5822f4496d94dd1d5b94e41374cf052e7b8d8bd3c0cadfd2433fd99d23d200ad5b14640f7198e95bcc02971
SSDEEP 96:nN3kidJ1uOijwpvWMoiVmdeHhp4cmUWQyV+VDCzia:nRk4YvGWMX2rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 495cf2701b637095b27199f4dd7b6669073c15133944f3e71dead34ab9cb3ff7
MD5 69af8fbe6af826336a0550884a59f64e
SHA1 3bc134f36e8d6562a1407855f6eae2b1fd696eb6
SHA512 9ba6abe6aebe951d07ae60ff57906e327bdcfc69dafd128cee0f9ba96059355be7d7af1b91a9d67b42b5f9a732a045fb27329522d78623b569727db63f865cf6
SSDEEP 96:nNBkMdJ1uOijwpvGJzWMoiVmdeNPMwhWjRkqhpRP8gcmUWQyV+VD7AiEwb:nbkKYvFJzWMewIKqRrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 3dca3ec65d1f4109c6b66a1a47b2477afaf8d15306a523f297283da0eccbe8b1
MD5 1b1b142e24215f033793d1311e24f6e6
SHA1 74e23cffbf03f3f0c430e6f4481e740c55a48587
SHA512 a569385710e3a0dc0d6366476c457927a847a2b2298c839e423c485f7dcce2468a58d20133f6dc81913056fb579957e67f63cf1e20b910d61816210447cd1f1f
SSDEEP 768:nl2WUA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqLlEIrUhy:nl2WUAu1ja7L6hy
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 94e4ca348ac6eeb384865078e8bf139afd8c0c702966aebe3770caa8d4537c72
MD5 267bba393f28a932247b6c0ac9f7afb2
SHA1 9769bb49e8e746a3b8ac1dc298b35472ef48670e
SHA512 da5a79bcc4a50c17811b703390cf1a1719dcbe9ec327720fe3425914c91859e3d3f192a6787e20f34f79a44e02ed335cc5415fe12590d90790ab2afa775c1057
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58cea5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cea5.TMP
Size 1KB
SHA256 f081cf3f129dad34f585f54b163b3677237c02bd8d212b52bd08b85507514ebd
MD5 12b6e4929e8bfc715b611ae14bcb591d
SHA1 ee2aad2321eab3a44940134ee17db7dc77d0c046
SHA512 78ca81fd1d05bc098dbcfde5367b8e60c57d9c02c786935c9b3e61270a30dd15a3191919b7603d191a9c3bf99c821a3b5866273327e7c28a10dd2df92cfbbfde
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 6895860b73b70f9af9ce5d558646b3b1f0824abf0107fd8ff350ae3d04e5367d
MD5 e3c51af81ef4771be786af7e71f7f0a1
SHA1 8a879bc72d9637091394b2708ca0bf693bc91eb8
SHA512 26c02255d3177457246e17b4f5e3d08d28747fcdc71d45cf4f7a4e150b362c223039c331e14aa14c61c081e6725e65a79cd157f6b8f9c15c87be841b2b798b2b
SSDEEP 192:sHoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupq66oqe2RU1dEQbSVBXKr5:E9iIxuERzA83h09RZxYT67GsVZcrp3
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 14c22e08f142b2e825849968b20f93cdca2696f45c8a09b38034debe1937bd61
MD5 c26b68aa0eaf7c1df99bdffa06843da1
SHA1 0df2aa46d07d2bfb04386ee8056ffb04fac91436
SHA512 14a384339642f49fae8bbaa98d15506a60bee80d48d73001e512680fefce129ee6ca53824a8864dae70a0be5a6b688f07f10ebe1c0eb406ed6687c59da169c45
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupq66oqe2RU1dEQbSmBXKrr9:A9iIxuERzA83h09RZxYT67GsmZcrp3
MD5 SHA1 SHA512 SSDEEP

Submit Download