dccd21c9dd6cc34a95359e1cb4a4c40fa90057785e556c9c73d6706822dcb448

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231222-en
resource tags

arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system
submitted
13/02/2024, 12:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9960de9faea2ba38ea97e46fb276ff21.html
Size 35KB
Sample240213-n8cpysad97
SHA256 dccd21c9dd6cc34a95359e1cb4a4c40fa90057785e556c9c73d6706822dcb448
MD5 9960de9faea2ba38ea97e46fb276ff21
SHA1 205ddcabd46ee9b21284d91ea6c9961994c49271
SHA512 3774659c28ac541f7ded7b53335119620a7acc9a83f4fe854c9d96841f727177cc1036937b107361a034d1ab13ae922cdc20808c7fede6f7fdb3944584824d29
SSDEEP 384:SBn+SDxVkZYqO8OW2QZhqgKgSe7Dm6Psr//VLvBawoKoQcCFx0JY9dkc:SBnPSZYqO9pe7S6P8/ZBzR70JY9dkc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
4244	msedge.exe
4244	msedge.exe
3144	identity_helper.exe
3144	identity_helper.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe
1580	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe
4244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4244 wrote to memory of 3520	4244	msedge.exe	59
PID 4244 wrote to memory of 3520	4244	msedge.exe	59
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 4976	4244	msedge.exe	86
PID 4244 wrote to memory of 1636	4244	msedge.exe	85
PID 4244 wrote to memory of 1636	4244	msedge.exe	85
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87
PID 4244 wrote to memory of 4960	4244	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9960de9faea2ba38ea97e46fb276ff21.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3d9146f8,0x7ffe3d914708,0x7ffe3d914718
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6960 /prefetch:1
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6756 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7008 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8002082857872200826,17055911479882772242,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1580

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77EC63BDA74BD0D0E0426DC8F8008506

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506
Size 330B
SHA256 3d33d9398fe754e457f732ae8b62fa9214fb2963974972cfb33ca6c0b12924bc
MD5 f3afb081dd1d63728c19fe983dc1effd
SHA1 edb0fc8fa8bdbf115913d889655d8e0cf2bcda64
SHA512 74089bf04509f2c3fd1436e452f3d9f088499dab07af223ef4e1fe77a8309a169c18fdfff550857fe44f95b2946c89cf7320e8a58512727f0946247c52a42846
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a7c79320a37d3516823f533e0ca73ed54fc4cdade9999b9827d06ea9f8916bbc
MD5 1386433ecc349475d39fb1e4f9e149a0
SHA1 f04f71ac77cb30f1d04fd16d42852322a8b2680f
SHA512 fcd5449c58ead25955d01739929c42ffc89b9007bc2c8779c05271f2d053be66e05414c410738c35572ef31811aff908e7fe3dd7a9cef33c27acb308a420280e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 404040fd5fbb71d209e10f48b9c9dfb80536b4b170b8c50ce42df71b391865ea
MD5 bdabe35a9b606e315e0fb3214b914db0
SHA1 75b3ad0d6569ebd5cddbb33b9e3a5d581e5830e5
SHA512 92bd136e86228fc2db1d584a526cec4b2c9c0d65029f98c69dec350f02cf7c8b8a2c659a1898c2d11ae97fb65d83637c515a305ffbf6e3c288d1bd49eb2b1e88
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 659ad42b749f50164d69b3783cd2ce41acabf6e69898ff1b58f73ec746247deb
MD5 376215b871ac39dd9bee51e6185cf464
SHA1 2dbc11e7476265c1c8d1c802df10288fe011ae8b
SHA512 1eebef358864ad197605c993fd43561a9a7bf458bdf8d129f431c63a6ae96dad9fa0124579fd80f3c04545c86513d1a5a78bdf9e1b1e0ddf41a538fb8a1c006c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4f140655453e88597a5c50540c361c18de5b7908488877cadc3bb4d3c9468df1
MD5 2671697de5ca8470c22dfa6fff4fd666
SHA1 33cd35c2be35dc6f852c4dda6ea0c751b0c617dc
SHA512 51804486042fbc1f4d5d1f643cf7ce12643d066f88995506b9b66683dac8308ceb0e71d621d4424d0d0f20f77778afc1f83fafd59a055977654fb62921b9c691
SSDEEP 96:nJkd71s/aO5wpvWMoiVmdeH8P8YUWQyV+VDCzia:nJkxGt5GWMXe8Yrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0ef8c509601671c910f6a5e9334f633ce1b88e8450014b937c7e5eb15057a72a
MD5 ae996798deaffe90c57e1a3bff3cbc0f
SHA1 5f036898b3f7f6703f09280b0a9cbaef1b81896a
SHA512 4422e022097487778990c0ff0def9df94ddb1f2371736315db21a6ddc7831a165e51c2da844d84e5abb77eff3d288638dd7a5493b9baf12b8fa5048471a50a7d
SSDEEP 96:nDk471sPaO5wpvWMoiVmdeZ8NUoiRzE828P8YNUWQyV+VDCAiEwb:nDkWG95GWMJ8NUoiRY82e8wrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 86e595be48dbc768a52d7ea62116036c024093e1302aced8c29dd6a2d9935617
MD5 e664066e3aa135f185ed1c194b9fa1f8
SHA1 358ff3c6ad0580b8ae1e5ef2a89a4e597c2efdc5
SHA512 58710818b5f664006a5aa418da6c8cd3f709c2265bc161f81b9dfe6cdb8304fabaa4ce9deba419fe4281623feeeaa0321f481ae5855d347c6d8cf95968ee905e
SSDEEP 768:n/MWlx8F1+UoAYDCx9Tuqh0VfUC9xbog/OVvLlJorUlrIffY:n/MWlxu1jaaL7lrGY
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fecefa1816cbf142ea79dbd4914975258beec8a72d0061e86fd446b493952656
MD5 257b3d2db96c21291d58733cd279232e
SHA1 56355151c448d965aac2a219397f3fadee71ff60
SHA512 c8d6d6708db0f2ffc1b833bdec7fa51661e5448f8ce8c4c7402d8004e6f0702ef3a9541b732570eaa8286c9331bd3d1b4671494c493b98e3defb9c7a19fb93c5
SSDEEP 192:9oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuphCe2RUlyg8DhTw8AftwKCi:x9iIxuERzA83h09RZxYh8fFe86W2F
MD5 SHA1 SHA512 SSDEEP

Submit Download