d00baf8eb73d893756818264a049ed91c3aca97ba566eaedff207837888885be

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9851461e6c1669b39b136e9254a9fa64.html
Size 63KB
Sample240213-dlkf6sfc96
SHA256 d00baf8eb73d893756818264a049ed91c3aca97ba566eaedff207837888885be
MD5 9851461e6c1669b39b136e9254a9fa64
SHA1 6ae23a06dbb45ba6d84c89a75717ba461a9638a4
SHA512 5333efc92b1d4d0316a21952c1fca919ae4b7f46688de593a5e9afd62fa6fdde1127f581cbf7213b193dd135b778415ab9ec66e53aeb8f0215f88ba16f859759
SSDEEP 768:xv6P+oaRRhvaaYS7uXbKjM98YnEQrMygipmu3vykDLPseKxHasoFmV73e2SCE84o:xvDzRRVTuXbl987jumcvyyFmp3VtdtV
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
848	msedge.exe
848	msedge.exe
3236	msedge.exe
3236	msedge.exe
1756	identity_helper.exe
1756	identity_helper.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe
3888	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4172	3236	msedge.exe	18
PID 3236 wrote to memory of 4172	3236	msedge.exe	18
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 3728	3236	msedge.exe	88
PID 3236 wrote to memory of 848	3236	msedge.exe	90
PID 3236 wrote to memory of 848	3236	msedge.exe	90
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89
PID 3236 wrote to memory of 4604	3236	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9851461e6c1669b39b136e9254a9fa64.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe27b146f8,0x7ffe27b14708,0x7ffe27b14718
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,2941579947531311547,17256712922320779296,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cbb617cd6cde793f367df016b200d35ce3c521ab901bbcb52928576bb180bc11
MD5 5e77545b7e1c504b2f5ce7c5cc2ce1fe
SHA1 d81a6af13cf31fa410b85471e4509124ebeaff7e
SHA512 cbc65c61334a8b18ece79acdb30a4af80aa9448c3edc3902b00eb48fd5038bf6013d1f3f6436c1bcb637e78c485ae8e352839ca3c9ddf7e45b3b82d23b0e6e37
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 336B
SHA256 6e760699c7310a0bcce734945f6f8bb65958179f16db787ebf17290ef1deea93
MD5 a0285fdf9e8c3ada71b031e4b64182e9
SHA1 72383b16d0f87e733b08dd4e77d06d4ad4946d03
SHA512 9b313481169768661343c5e65d258954a2f6a2d456f65ed9f48233d8c419adb17e46d70048aaf424e32802bfafebe73c913b225cc907649aa691810d155d86cc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 3c510f622d02abbf45849b20570f71fb4ac84de57f589596742d445e7b46c716
MD5 639c4f76488a3380d32318ab9816a1a3
SHA1 8fe62eb7d9e8e8bdecd27b5a809b0e41cc5a6051
SHA512 6bfd4700495882f79a4d1e7d5f2b0fa37fb445f899e540e01a355ac551757a32264baedf516338aeacd4d81fc379c89110b8c5eaf86b56a1a7421f76a1fa4cae
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e5339cc78ffc35a6fd662ad94e99a1f5899c4c01d59b52dc1969b0b78e1996cc
MD5 e679343f1903dbd93672bd5189fc8cc8
SHA1 b8f4616898a1964e22eea91bec2f99508b7789c4
SHA512 af02832d2bce13c37c759b15348cbc630a96aa0e1d80087432d6eac4bfe7161790979a8ed1daa4e541457e06162b9a268c4469f99984703e639b35737c03f594
SSDEEP 96:nDkYN1WWghnswpvWMoiVmdeMcWkt26xP2TM+gUWQyV+VD7AiEwb:nDkoQWgmGWM8cWkt26xP2+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 69b6807e1f2b5ef8954bcb65c57de267ad238aa54f767b51d0db974cd6ceb1b9
MD5 637fcb9b9bbd4d11c1a810f781aba236
SHA1 23327253ea513aa8e5fab4619bc4f9cb318afdab
SHA512 191ffc76293eb02d0eec4f37afd30bd0fb8d4720f7592d43a87783d4d543e5eaf69bb44bd7f950c18e8018d1cdfc2ca6a9c95b6d8bae562a2aba42faa56fb291
SSDEEP 96:nJkdN1WWghnswpvWMoiVmdeHTMzUWQyV+VDCzia:nJkbQWgmGWMXerj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 c29d955f746ca3882b8003516398f3adfa2e4a6cb47089b8b99870021bb7ef87
MD5 8fa0eaae093d4643af4d834412fffd42
SHA1 d12a8572b7dd68438e22dad9b71550191495cdf9
SHA512 3f6d17af5f6bd59b7c7f6607dd8738bebd4a8db976462cb7829c974b50d830861dabb226abf16545bfe38ba2f32deb46c223990ca4e2b85abafcda5027578c2d
SSDEEP 96:nDk4N1WWghnswpvWMoiVmdeMcWkt26xP2TMCgUWQyV+VDCAiEwb:nDkIQWgmGWM8cWkt26xP2CrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 7b22b0b16088ab7f7d6f938d7cfe9ae807856662ce3a63e7de6c8107186853e4
MD5 6db2d2ceb22a030bd1caa72b32cfbf98
SHA1 fe50f35e60f88624a28b93b8a76be1377957618b
SHA512 d5a67a394003f559c98e1a1e9e31c2d473d04cc075b08bb0aab115ce42744da536895df2cec73fa54fc36f38d38e4906680cfacfbf4698ee925f1609fbb07912
SSDEEP 768:nYXexSxWTfbn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVqELl200zRrUNe/:nYXexSxWTfbnu1jaDELMZzaNS
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 025a40adaad9bccf8dac9089b3068e27ed50dc5b778b64adbdbb139e53a90807
MD5 b74e6b252d2d6b7619bcc6605b2f99da
SHA1 ad226673455ef9ce8dddebc840268b73e8c83dd6
SHA512 c7e6649862aee44a0558034aca5883b4f7a1ece72fa4faa3db9fe3550bc4fbcec1520f1e8949ba5f98b77ad5504d15c14f7004fe1fc14d23a86caa76a3f9ca4f
SSDEEP 192:8oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSTDe2RU+GCShTw8AftwKCA:s9iIxuERzA83h09RZxYshF86W2n
MD5 SHA1 SHA512 SSDEEP

Submit Download