0d107e35ad72bf13ae737bbde9f010807decfed77d76195966ca28a09de2f1d5

Analysis

max time kernel
137s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27/02/2024, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a97b6c32fe3d7cc904cfd21944c7edcf.exe
Size 424KB
Sample240227-spp86acf4x
SHA256 0d107e35ad72bf13ae737bbde9f010807decfed77d76195966ca28a09de2f1d5
MD5 a97b6c32fe3d7cc904cfd21944c7edcf
SHA1 34f08b34b23163ac92453271c45838bc6f3af5e6
SHA512 62d8fa65936a9cedc30fbae7c30353249ac0857462fdf24c4b70467477336ad5ca463fc489fa87ad1c5f8b975a8340ea332b9c5913bfa66aaba8778066a7db5d
SSDEEP 6144:ceYfD7s6tgQSmI57YFFKu4dWcxKohCzxeFxub15c7ds1yAOGHeBY:ceR6tfSmI50FKum6eFxub15cRxoHcY
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1324	msedge.exe
1324	msedge.exe
4572	msedge.exe
4572	msedge.exe
4980	identity_helper.exe
4980	identity_helper.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe
2488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe
4572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 4572	924	a97b6c32fe3d7cc904cfd21944c7edcf.exe	93
PID 924 wrote to memory of 4572	924	a97b6c32fe3d7cc904cfd21944c7edcf.exe	93
PID 4572 wrote to memory of 2756	4572	msedge.exe	94
PID 4572 wrote to memory of 2756	4572	msedge.exe	94
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 3936	4572	msedge.exe	97
PID 4572 wrote to memory of 1324	4572	msedge.exe	95
PID 4572 wrote to memory of 1324	4572	msedge.exe	95
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96
PID 4572 wrote to memory of 4144	4572	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\a97b6c32fe3d7cc904cfd21944c7edcf.exe
"C:\Users\Admin\AppData\Local\Temp\a97b6c32fe3d7cc904cfd21944c7edcf.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/axstin/rbxfpsunlocker/releases
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce56b46f8,0x7ffce56b4708,0x7ffce56b4718
    3⤵
    PID:2756
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
    3⤵
    PID:4144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
    3⤵
    PID:2084
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    PID:4424
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4860 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4980
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
    3⤵
    PID:5116
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
    3⤵
    PID:2288
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4948 /prefetch:1
    3⤵
    PID:5056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
    3⤵
    PID:4836
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,957072015319466239,11435543411881279872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5156 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50CD3D75D026C82E2E718570BD6F44D0_02835C6072261A584AE38D197B622594

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\50CD3D75D026C82E2E718570BD6F44D0_02835C6072261A584AE38D197B622594
Size 312B
SHA256 d75419b6f53917b302c4bdb19deaecb18473fe773f3aee25af20fdade65a4e12
MD5 3ef4efc4cd3d5a7618f403f5c99eb63f
SHA1 62d77b8c3a51a1ce774364257255e33609f5cb4a
SHA512 cb910fb42801b2aff93303f5df7b1974df45c16b6a98dae982f3bba90a4770f3f7fd5ff9e916be36c5572ddc84023a3f84ae904bce76706cd849ad531113aef1
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Size 471B
SHA256 a7ee4c4e5e20601041e975ffce77ea90de35e4f9d008064737fac1954867e832
MD5 6520129df625246b2b9a7f7551ddda75
SHA1 db7f5396646534903f752544a3601f6d41047257
SHA512 dd09f5e818904c9b9ebab74d9106a2ad75224eea1f677ef2d40dfaf7f63077a1979092562dead6219693e76c59ee846a579065e4e7a30ef2b7f281693656982f
MD5 SHA1 SHA512

Submit Download

50CD3D75D026C82E2E718570BD6F44D0_02835C6072261A584AE38D197B622594

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\50CD3D75D026C82E2E718570BD6F44D0_02835C6072261A584AE38D197B622594
Size 400B
SHA256 3f5729a2c5a235f03eb58ccaeae7ae530c1a4147d879f4f372752eb78f239991
MD5 2a83d52d107bb3845e173bf8af76aaf1
SHA1 027f0dd739840b5209dc295053682ecc1432f7d7
SHA512 00bf0125a2f7fd6be6400308aa22c86e7d157e6ffafad92e1d5196fd3afe4f77fe9ccaf42e0725b98deba4b82dc70f094d51bad88bf65b7cb372fc9016272524
MD5 SHA1 SHA512

Submit Download

B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B398B80134F72209547439DB21AB308D_ADE4E4D3A3BCBCA5C39C54D362D88565
Size 404B
SHA256 6ebed3dce4cd283a346cbb045bf42d0a4d168b507a3a58070ddc59a092b85fb9
MD5 5f06283e8ae03157dcd2608b0fbec368
SHA1 5ce26891abb5cb271750d5a9a3de1de817bb5723
SHA512 244e35acd4cf3cdc0ae5657df969a74f580bab6254d54f00ad6a962229909bf63a8a1889c195e55cd112464c7e9235c637ed22e3af4812d1fe2600a8293ad41e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 25513842bfc631db3c7f7ae0207fd50b5a22dec703c6d49831ff2f0aa0e8f558
MD5 bac1ce6b35291124985c62211fb043eb
SHA1 2d9948e82e6c8a9fc444f1f94781e557cf99c030
SHA512 d21c26e70f88d6404d45ff6a475adb65b8db529842a7e30981987b6df2963df38141bdca0463d926c6445b17bb3f41b775ce1db8ffef5e6ec6f8ba16ebf972d9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 496B
SHA256 9ecae06af7ccb6ec9a8826d37b6fd2ca90a7b58c2daf84497b582141db80b4f1
MD5 d4c46ae160e47b8e5638323df0eddd80
SHA1 5a0f0cf97f9ffdf00ef86177ed74c27acccc7054
SHA512 056a890b5555af784a7c350bb8dc5ce62c818fbeb61a0ce4ef91396683d6b774db960cebdc1da55ddaa671631c733aeb30393ac588afd8a2d71d4914846666f4
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bc5928348911763ccc49845acf79c8bb45568fb0f887a4fc0c82353c56432df3
MD5 4ea3c781f4420196096fc53de1c04f14
SHA1 55bbe11c5f89223cbcbaac4374f695cd36976494
SHA512 22428f1f17c6feb79267d73d77bb35b86590c5d129f8fde16f870233c39a86aaeb3f67e362f1d86b381ea95f7245ea7822fc16c8b6e4bb783280b64773324507
SSDEEP 96:n8kCfY1dewpvWMoiVmdeHOHTsaUWQyV+VD7ziEwb:n8kzveGWMXETrrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7b93bf338ff443cab06da3a42cf6ee6d2cab1e43d541291a3ad2d0769ad71cbc
MD5 7df4f6070ab18d4d2186218d8be3fbf1
SHA1 348ce6ece44acfef900e9df706943861f4e7f14d
SHA512 e41f728ba63035d12393286ed04ff739c852a8aadc8bdb31a60596e1441412a3658d4dc1c5f018d26b169cbc847af58809e9b64afcfdb3226963e7d455552c25
SSDEEP 96:n8k4fY1duwpvWMoiVmdepuWI1jOHT+aUWQyV+VD7AiEwb:n8k1vuGWM5uLhET5rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f18150c1e53977b308894112e3df256eca2d57e2b030293c99bbc43e8a4b7c66
MD5 86b7314eda129b1c9ab3c81caa4b0c7b
SHA1 52b36b4b0bfa1e112e48786a6fd9a6be21c5cc49
SHA512 3eb229502954d783e992adb12260aff43ed1b5788d8429323753a20da860f46a7a7ff3275a516e1dfae8108cda6606bb8e4cffc797a96557061615277e221c6d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwe2RUcybR59xUX1MPeuu0j:A9iIxuERzA83h09RZxYu859E1MeuBOFm
MD5 SHA1 SHA512 SSDEEP

Submit Download