kinsing | hxxps://www[.]google[.]com/url?hl=en&q=hxxps://google[.]com/url?sa%3Dt%26q%3DH%26rct%3Dp%26esrc%3Dcru%26source%3Dweb%26cd%3DXQB%26cad%3DuQxMt%26ved%3DBba0EUC3VzYm%26uact%3D24%26url%3D%2561%256D%2570%252F%2567%256F%256F%2567%256C%2565%252E%2561%2565%252F%2561%256D%2570%252F%2574%2569%256E%2579%2575%2572%256C%252E%2563%256F%256D%252F%2532%2537%2579%2538%2572%2563%2534%257A%26opi%3D385416742129%26usg%3DvY3uTcWChAKOg&source=gmail&ust=1706259535901000&usg=AOvVaw0-qj7hr0bu4pPE0rEabIY_

Analysis

max time kernel
277s
max time network
298s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/url?hl=en&q=https://google.com/url?sa%3Dt%26q%3DH%26rct%3Dp%26esrc%3Dcru%26source%3Dweb%26cd%3DXQB%26cad%3DuQxMt%26ved%3DBba0EUC3VzYm%26uact%3D24%26url%3D%2561%256D%2570%252F%2567%256F%256F%2567%256C%2565%252E%2561%2565%252F%2561%256D%2570%252F%2574%2569%256E%2579%2575%2572%256C%252E%2563%256F%256D%252F%2532%2537%2579%2538%2572%2563%2534%257A%26opi%3D385416742129%26usg%3DvY3uTcWChAKOg&source=gmail&ust=1706259535901000&usg=AOvVaw0-qj7hr0bu4pPE0rEabIY_
Sample240125-tp5vaabcfl

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
2896	msedge.exe
2896	msedge.exe
1152	identity_helper.exe
1152	identity_helper.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe
4144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 3096	4556	msedge.exe	86
PID 4556 wrote to memory of 3096	4556	msedge.exe	86
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 5084	4556	msedge.exe	88
PID 4556 wrote to memory of 2896	4556	msedge.exe	89
PID 4556 wrote to memory of 2896	4556	msedge.exe	89
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90
PID 4556 wrote to memory of 5064	4556	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.google.com/url?hl=en&q=https://google.com/url?sa%3Dt%26q%3DH%26rct%3Dp%26esrc%3Dcru%26source%3Dweb%26cd%3DXQB%26cad%3DuQxMt%26ved%3DBba0EUC3VzYm%26uact%3D24%26url%3D%2561%256D%2570%252F%2567%256F%256F%2567%256C%2565%252E%2561%2565%252F%2561%256D%2570%252F%2574%2569%256E%2579%2575%2572%256C%252E%2563%256F%256D%252F%2532%2537%2579%2538%2572%2563%2534%257A%26opi%3D385416742129%26usg%3DvY3uTcWChAKOg&source=gmail&ust=1706259535901000&usg=AOvVaw0-qj7hr0bu4pPE0rEabIY_
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe353e46f8,0x7ffe353e4708,0x7ffe353e4718
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2644 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1828 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,3101661647737120271,10315638732749761576,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 8917df6367c09fc9e8b7008b892527b98c9881d4a711f135fbcbb75a1377934c
MD5 44fb4b00dff8b512324ceba1a6141cd9
SHA1 be55ffe98b5b75087480af9480fa545f44f91ca8
SHA512 43c01ec8bb9882767653ebc7175f51de84f9ce66b8a32fb477a27594fc57b4ceda6b0c9f0c6c8c132f10e404f52861a61b7cc88e2c7dc83e308e73b4d8166ceb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5569e5a8d49e74cca4c4ec080a5b17e8f7c2e8179111b11a83303e2b69cf51b6
MD5 a8468cbdc248590771e766876ab5c04f
SHA1 350ac6a1f7a2f0a7883f5e9d14e967c7c434dfef
SHA512 bfe7d52819aa7b9d228a59358e5a9fee024c285a4feb16fc034d939919e3751b38422b6c11ffb675eb2955dcf4fb7744bdf162019a577128e468580e621b7471
SSDEEP 96:n2kaV413TlwpvWMoiVmdeHcQIu1UWQyV+VD7AiEwb:n2kaGlTlGWMXOu1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 de58c22d9b8ca3310ed1f8a511ee4baa6b2fe0c653d13241d8402e324bb43c98
MD5 a9fb119549195eb9bc4f84756351c323
SHA1 eaace192999e90d7dd66d2a0f77ffa156a92e702
SHA512 28035c5ba7e6a7bf37441ccb51d45386e84b6e2c897f82e207472f938a0641010c4c848ae04787853de7d7db22f20108e61ba8552eebb9bea43b20fea7e200e0
SSDEEP 96:n0kP41LTlwpvWMoiVmdeHcJu1UWQyV+VDCzia:n0kAtTlGWMXqu1rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 81e62b921548bde4576c821c0ead34cf8058d5dd2d4f9d9e7d0b7300b870e8d8
MD5 ce440fc120c28429fae47f953a4d23b4
SHA1 d766305c1c4fa7ad8147c0ec1cb9ee938c0adbf4
SHA512 efbdba243b4fb80557b9d97f9c8be72959172d75018571e7853875437370fce9b0d0837a756b603d9113a27bd827e75a9d618f3ba74564390dcce23771fbdb36
SSDEEP 96:n2km41LTlwpvWMoiVmdeHcQIu1UWQyV+VD7AiEwb:n2k7tTlGWMXOu1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
SSDEEP 768:nrCWQ08F1+UoAYDCx9Tuqh0VfUC9xbog/OVSLllmrUBd:nrCWQ0u1jaXLVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5053ec309118c55b0560f8cd4d7d8ca263de5ff82997e41d5bd56f415c9fc1d2
MD5 914bc04cc40890bd3f53ce32626c9bdd
SHA1 6925e48c1073b43fdffd6db076a7441568404604
SHA512 3e3eb4524ca33020854a3c3f652b4d5ba02dc6fd62c5808908f4e5a106b06a62beaff5e7f6b5fddeaec10b793ba9dc6c75ba321979a112fe3478f5649dba3760
SSDEEP 192:WoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWtzGe2RUIjc6bHTxY/Q3pA:S9iIxuERzA83h09RZxYWu3TxWq1QNCJY
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 bd972909f31a7b9fa4d0e7bf2b62800fe8c0f376e687318f9d698f51abfced75
MD5 ad41016255ffc6e76e82f58e4d427253
SHA1 12708dbff4e674b8d1e325349509a030efef988c
SHA512 9ef9cbfee5d1644ad39273465fa1c718d8d9f3dded16e68c9b19275e5511e7e01ee0418a538af4c9f19b5a4401a22b88a78955d8d9b06a7d99ecc1f21a8df449
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupWtzGe2RUIjc6bHxxY/Q3pA:A9iIxuERzA83h09RZxYWu3xxWq1QNCJY
MD5 SHA1 SHA512 SSDEEP

Submit Download