14104c10e004afe6e22de58853852ce3c946393fd040c1be9bc0f5dc43bbb7db

Analysis

max time kernel
146s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240221-en
resource tags

arch:x64arch:x86image:win10v2004-20240221-enlocale:en-usos:windows10-2004-x64system
submitted
24/02/2024, 13:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a2008a2bc0c5fba58d7bee6655338ae0.html
Size 58KB
Sample240224-q3313aeb81
SHA256 14104c10e004afe6e22de58853852ce3c946393fd040c1be9bc0f5dc43bbb7db
MD5 a2008a2bc0c5fba58d7bee6655338ae0
SHA1 dc27e5089669062a6fd0a4ffca5d3b8dd7c13898
SHA512 68e3852e471cec5ea7f48aa84b1ac7fd7136c98d55290a73d9614dc177047b46348db5bc4cd97287d8a43b0eaf64434968b80ed16cd773057327b86058d5fc26
SSDEEP 768:AGBpEQ4oFjInJvfp1PQqvtDSFXUpHx6eC7B2NujvSj+bLEHEuRK0E7EiQX1hzH1v:AGBpLFjIJvHQOtDSF0Hx6eC7BjSN5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
224	msedge.exe
224	msedge.exe
1552	msedge.exe
1552	msedge.exe
4532	identity_helper.exe
4532	identity_helper.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe
2752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe
1552	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1552 wrote to memory of 2496	1552	msedge.exe	53
PID 1552 wrote to memory of 2496	1552	msedge.exe	53
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 432	1552	msedge.exe	89
PID 1552 wrote to memory of 224	1552	msedge.exe	90
PID 1552 wrote to memory of 224	1552	msedge.exe	90
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91
PID 1552 wrote to memory of 5044	1552	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a2008a2bc0c5fba58d7bee6655338ae0.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb36f446f8,0x7ffb36f44708,0x7ffb36f44718
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,15589056593687622215,6699963509681355964,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1336 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3328

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0b3cf8ae20afd84c9bf06546e876c84922cb5800526df72a628479f4d5487df7
MD5 91746379e314b064719e43e3422d0388
SHA1 65f1a2b5a93922d589142a6edf99b5b35d986dba
SHA512 a783d8d9613cf92020fc36fd27d384dbd4e105a1ebd02c4507bf7263e61ff5b377e6d1734b066700782fa64bcbeb11af31ac3972d404625cbdb587cfa3bc0808
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 ef08e2971a9ba903c9b91412275b39aabfd6d4aa5c46ade37d74ff86f0285420
MD5 ccf8b7b618672b2da2775b890d06c7af
SHA1 83717bc0ff28b8775a1360ef02882be22e4a5263
SHA512 eb550889db8c4c0e7d79b2bd85c7d0e61b696df10ce3d76c48ab21b935c7ecc7b12403a00d6570e7d8e4121f72747242c2358f8f0823f804e704bd44ed603b97
MD5 SHA1 SHA512

Submit Download

43da11c7-6454-44eb-9b46-4c044bbf0ee8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43da11c7-6454-44eb-9b46-4c044bbf0ee8.tmp
Size 1KB
SHA256 7b38ababfb40f4a7feed944409eb5aefde5f26b4f2678025ea729d4aac96d391
MD5 7268121a76991464662f2d3deaaf695c
SHA1 ab86c8cf91ddedd9083a955e7bed88bc36211ea5
SHA512 1fb823b1d331e9904fbbac2acb1bcd32a13630d872f35f61efa53b51c9e1a29a53c8d31caff5c25a77717a5b8571882484d18f3ddc591920fb6c5f2946ee8155
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 e5247c3a84dd55fbf73c7f5447bbd009a5ae3dbeca3c0cd10b8ba00c9f413a5b
MD5 d1112a6ec0c19661c89dc2bea780d439
SHA1 ef69b56abb0d16ce1c78a52515128dfe459c6af8
SHA512 1e43b706f038dd57cdb37b3eb8319272049b5a20bb74eb81bada1fcfc5a7f0101130582ef5335455169f55441cb62f49a84ea74d4f4c2ac19fa0cfa9b6711654
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f3d306ee1ee25f68dc535aa4968a75734e663d6937ae9d030fb6ecea0b513c4f
MD5 736bf973be0fdc9e9230f0daab3240fc
SHA1 138de05935f152cdb503ce5626b9b80632756268
SHA512 a0d0f80d69f1de988b1c813c43bf7af20878e3505c3ae2fc5296131514f49092b8efec18a6f9169490d71c218174963ff45cafa7bcb0eaa9a2feda4f0e6e7ae5
SSDEEP 96:nVkHSxm/Fnmq61zLGwpvWMoiVmdeA6LDxI2lQwnoXVTUWQyV+VD7AiEwb:nVkHP8J9aGWMQ6LNI2lFoXVTrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 46ecb540e7b3c3d0e118bb574a17d9ab04f94791456793db68b727d95fd35530
MD5 4e77022ad34e4cdf12997cd599ce10fc
SHA1 894d4c17cd24abd4636c074364684d649eb5437b
SHA512 d34d5bbe27acf585d9bad632bbedab49f64a2d2f2be633af7e4cdd643ff80244760ed2702402366ad64cd7014cc60f4e4700c92104c4f66de199a28c686dd79e
SSDEEP 96:nVkHSxm/FQYmq61zLGwpvWMoiVmdeHlQwnoXVTUWQyV+VD7ziEwb:nVkHPOJ9aGWMXlFoXVTrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 9cba58ed8edc00dfcbc64a921cf9c26287cc2d7a6c868bed9e785a66df1cd49f
MD5 1f08c3fdd94898b7a27d035c31bc06d2
SHA1 c204c1c27128a6adee763fa0ff95826641fcb0f4
SHA512 e95a3ba60716e77361c0744969161d626570044989936147727e98cbe97cc48c326a5b235b296d3f2db18675d2d32f4e53e4252cf0baec9ba100c4dd46b942d2
SSDEEP 96:nVkHSxm/FQhmq61zLGwpvWMoiVmdeA6LDxI2lQEnoXVTUWQyV+VD7AiEwb:nVkHP3J9aGWMQ6LNI2lZoXVTrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 302cacf33628843fa683434741ae53fb8520c130af07dc152426f83810a5aa56
MD5 084fb63ff0e138303a8562be323ff72f
SHA1 a0004850eb0be48f1bc699971863f3d34e025509
SHA512 f6bd65aacecfea3b6f69317165e691c8227f1381f694f6d0da155ab02152df6dbe05c2142b8f344dd1aa13353f52b4ee52d4767c3a79e4727fd1214ce52ff114
SSDEEP 96:nVkHSxm/Fnmq61zLGwpvWMoiVmde8x2lQwnoXVTUWQyV+VD7AiEwb:nVkHP8J9aGWMU2lFoXVTrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 372B
SHA256 a96563761a1058e9706bb7d592ac2b04c760a1d2024e688a60160c1055d3d66f
MD5 230fa10ffe6c3affe711bf13c0e1bddb
SHA1 19750ccda023a5078aa7c4365dbcc8664462dd1f
SHA512 6cdc83505deee30fd4678ae3d2a544a1e1518e5e93fb306bd353f238bce49c46471750a33925183481be1164cb42c0bdfa44a17d8d40a4b1477d3bc4665a32e6
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57e639.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57e639.TMP
Size 204B
SHA256 bee47e8c72d2967ccc99fb22c90d6c2f416e7eaa00f758ef3b802151205d90f7
MD5 ceb41ac01c5150b195d654950360a276
SHA1 6314597723f93ed6b6239c588d6e35f95d4cf69c
SHA512 0829a492dd9333d6ca6fecdbe2485c5c387fcc03fea3e76d954267c888c9c6e1c847c716ada3f1d696917c88246b20adc939b9d2c16e7fca39a054a2310790a4
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 9c55cf02ef237f33e4099f35b0c378af3a9d0dcfb1bfb012db67410d09103ab8
MD5 da532424defa510d66a1d97c2ebe623d
SHA1 e8dd5da43722846c52ef502afe2b54653e8d3ff7
SHA512 d272d73d58e0d600ac55fa47a4d67dc31f98fd9509f9fcff69439fe1e64e6e8d7e8912650239b95d39dd47e601810cde3f3b32de22cdb6e31768f08a8e929561
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptqrLLe2RUsd/sba69xUX1F:A9iIxuERzA83h09RZxYtS3NdZ69E1Me5
MD5 SHA1 SHA512 SSDEEP

Submit Download