kinsing | hxxps://checkout[.]nordvpn[.]com

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
25/01/2024, 17:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://checkout.nordvpn.com
Sample240125-vqqbnabdb3

Score

10^/10

kinsing loader

Malware Config

Signatures

Kinsing
Kinsing is a loader written in Golang.
loader kinsing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2140	msedge.exe
2140	msedge.exe
4236	msedge.exe
4236	msedge.exe
1072	identity_helper.exe
1072	identity_helper.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe
4236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4236 wrote to memory of 3356	4236	msedge.exe	48
PID 4236 wrote to memory of 3356	4236	msedge.exe	48
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 3464	4236	msedge.exe	88
PID 4236 wrote to memory of 2140	4236	msedge.exe	87
PID 4236 wrote to memory of 2140	4236	msedge.exe	87
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89
PID 4236 wrote to memory of 2836	4236	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://checkout.nordvpn.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcf24e46f8,0x7ffcf24e4708,0x7ffcf24e4718
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2968 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3996 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2948 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12255021342798562362,4496480506927141993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
  2⤵
  PID:4860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0c1014ae07c2077dd55d7386cc9cf9e0551be1d67fe05a6006957427ae09fec5
MD5 f246cc2c0e84109806d24fcf52bd0672
SHA1 8725d2b2477efe4f66c60e0f2028bf79d8b88e4e
SHA512 dcf31357eb39a05213550a879941e2c039ec0ba41e4867d5d630807420f070289552d56d9f16c6d11edcdb0f9448bf51e7d2e460e88aa9c55a5bfe5d8d331640
MD5 SHA1 SHA512

Submit Download

9458690e-dd64-44c5-994e-d56da5a2d986.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9458690e-dd64-44c5-994e-d56da5a2d986.tmp
Size 1KB
SHA256 0d4beba2d343c0b38aba7e2becd9e09dda43c935aeb737a55bf8274aec07c21d
MD5 c0e09ee9b933f1c63e1b74f477aadda5
SHA1 ae286f0a0160edc0e03b50a52fadf6e89e4c79c3
SHA512 8eb8e0fcc735fc944438efa79974c69d091ab76b341bdf8df4435df4751bd7c4e3dd5e2c5711d2ba6c4ea9052e985aff87a058a9536f3f1a188dd60e24e2e53d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 504B
SHA256 e6002dbdaa87d3307a8ccd11483dccd364d26fb9d8b2b70ed80b11280fb6152f
MD5 1e7d58cd57d7f17728d661324a80c16f
SHA1 89d0fcd4e9dcebfd21a83c28cf5060415ba0ccf0
SHA512 0dd0dbf24179f3b636b9612126126df00e8d94efb67f42b25d79197cdf74b6576d55afb13bb916591a677ea34d71aab8be8d96001f73c5666a8484735e93c02d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 672B
SHA256 3eabed1f07271f9173e56ab2afc6673b14f36237f9798dc59eb4c0fcd3251677
MD5 a73ad20e5aca2e543773cdbdf8c5898c
SHA1 6d672e6728d7149b1a46b285d9c2eef34e0a31a9
SHA512 61dac019af2dd6baa2bdc6efa676a47559423c284eb60f757777147eac93cf92c5d0b24a7ed5eea1b4eeee7c999a009d2f8e05f3af4d58412513474b5cee4f26
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 b430996cbdc95ed2cb28e995ebbf5d0fc6f68978dd9c83e49926a4fc5d558422
MD5 3499371c0a9e2bc81eb5a6ab715c35e2
SHA1 e0ceffc6067676fdf009cdcc25612008dd0b43d5
SHA512 55a46530ef00ba1c64222788a0195f0bc34ef352777615352eb80f61a20fe7b31f6ac022a31eb475a38adb1ddb1f8b58535fc78e56d3c1c96e4d6135a2fd1526
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d835d17fac10aa70d6d71d77aba47aa92ccccdb8a3a631632dab554dd4a43688
MD5 47be08bd0557706adf94b78f130533cf
SHA1 5737c21f1d7dc574d86699fdf807ecd152907356
SHA512 c42ebd16cd1bfe8fe58fc017e3fb2a85e15954a691836fd9ec11f6e02f7064e3104333ed60d464bfb7ace9e130ab97319c249191ff421b52c806651e48973c44
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 8adfd3577710b5cade3f4099bc3655b58dbcb922ae8e5298a13e8c57cce371ab
MD5 a05df7dbf5f7f4e0916d275e4f91eeb5
SHA1 663cd4171cfdcfc417fdca4f58e89e9502269d56
SHA512 00d2f9eb7130498262914dcfa45e0e292e6c5327e1dc5e0dde6a6df5c3cc8c06b9255ab56f7fbeb64bb4b90f586e01cbf21942279e6b58f3be4eb2f957e7a8e6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 ed16c169e0878e8dfab96c2fec91d3b9e3305d27fc95e1b16b00014df1bc5231
MD5 8d8bc96ce24f93c46e73f8bc217f94a5
SHA1 f1480166ccf07373ad789ba63bebcd0e409bcf8a
SHA512 a738aff700be2e684e4f6c9bfc60ad2fde0e48b5068c508ef62b56c090df6e55337fdad0ab0f2afca74f67a9683fcb8a447a58d1feb9efbf2d362113cc410c21
SSDEEP 96:nMkVI1JwQf4lGwpvWMoiVmdeUuK1kEzEVT8GF+t23bUWQyV+VD7AiEwb:nMk6noGGWMEuKbzEVTz+t2Lrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 cca0743d7502072269bd86b4ea9c7bb530f2096de4c0795ffb9062ec7a74bb2f
MD5 dc04d45551cbaf316f82a68b2a64d4f2
SHA1 f925ec65f88aeb87a847d947c1c2c1c00f9d7bf7
SHA512 ce4cab37682be28fc88f8772bb63952567df71f12aa3304d9d8235fb817d3e5a388b03922ed1f33e497e784df89fbb146dfaad303a58376f945e7937241b644d
SSDEEP 192:nMkcr5GGWM11w/nuRb/ln41PSuYzWQkuv8EVTRTt22rg:nMBr5XWTUb/zHVU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3d5aa30c4833d3df4f228a844a66090efa11f6af2809cda38ac67f28ad2db859
MD5 ac62647bd96e9418e9a0101be38de37e
SHA1 42790b0e85d66358b802b8261c42e5b5be54f79a
SHA512 e898b96fbde83eb5afcd3933acd81e2dbf512d2bed0997ef9dc5738a3fd55fbdf1b212e078d07c3d5e3593072919e88a2ce17fc1ced8eac4059711e06e3eeb4b
SSDEEP 96:n6kBI1JwQP4lGwpvWMoiVmdeH3cUWQyV+VDCzia:n6k2nYGGWMXsrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 43b38e54e20e927e366cab89cc6a5f05b5b54b435f3f28b8fe761fd4259b01d0
MD5 432e6a7456655fbc1ffc4a2d1a129f2d
SHA1 ef75be3633ef634844c520720636e22084486248
SHA512 84de3bf62a816bd2a5c7da8cc8453ee10c22dcd54849824e81123716cc00b7ac6e7579a66a55f5d1ebb8158b95d2eb9ed4c2e0faef5864b628997cde86dffcab
SSDEEP 192:nMk6roGGWM3w/j/lnPSuYzWQQEVTz+t2Mrg:nMDroXWXj/a1V1
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 23b683118f90c909ce86f9be9123ff6ac1355adb098ffbb09b9e5ec18fc2b488
MD5 5e62a6848f50c5ca5f19380c1ea38156
SHA1 1f5e7db8c292a93ae4a94a912dd93fe899f1ea6a
SHA512 ce00590890ed908c18c3ec56df5f79c6c800e3bea2ad4629b9788b19bd1d9e94215fb991275e6ec5a58ac31b193e1c0b9cbaa52ff534319a5e76ec4fc8d3ba54
SSDEEP 768:nhCWu28F1+UoAYDCx9Tuqh0VfUC9xbog/OVYLlsgrUSz+1:nhCWu2u1jalLaSq1
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 3c648521191d185b92c95f2c50b8dab41e766dab6f092535670a799d5007a204
MD5 8939a9762a0db6e67fd4851d516104b6
SHA1 bcb4c9e5e26d9b1cd6a0f5778f6327ca5eef81ab
SHA512 ffaf726c321c3edaca42bad9ab9e35bc3a2a0e0bc60602578f630f47398e0f6a7deceb78cd8047abf16ea6be37a9e5d1cd8babd6784cdc27b94e5cc6632ed34e
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe588b63.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588b63.TMP
Size 1KB
SHA256 64ce5179e54105c8b07fd9975c4de1eec86ac496369927d7ff136d2063744e06
MD5 f8be59cd07088181d95ca69f45f5ab2b
SHA1 7d3f7ae9e4fc0712343eb87847f106dd392bac97
SHA512 fdb3061616a8950fd8c0ef8070aeeb0c03e6c0fc170dcef111d78513d258dd0f6ecd38ae286d9d75d99834c5ac4944505a568f0e0812a082685f542804dcde76
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 1cb8649ecaf3f240fe63f5114b730d47360d83cadd5f2e034bae26da1fb412f2
MD5 f29851f50c84403a66cc25e25bd10048
SHA1 9177015b02d71fd4f006c1b689fc3b9d4855758f
SHA512 8c694f58f939c00a76b8de08a3c74ff48c6f02f35a71cbec6293a4869eb2ce4cffdee923f5b05d85a6d9c4f08583c6c4d9b5ce2e33f37a030d33518867b0adf7
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupgAe2RUyDebSKxY/Q3pnQgV:N9iIxuERzA83h09RZxYJFKxWq1QNCJG8
MD5 SHA1 SHA512 SSDEEP

Submit Download