1e4c0cdd766732eb5f9855d500ff24e054a82414a38002d05c1189982e45906c

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
19/03/2024, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d742f3872185aefd22b7211ca0806ff7.html
Size 60KB
Sample240319-2efreahd85
SHA256 1e4c0cdd766732eb5f9855d500ff24e054a82414a38002d05c1189982e45906c
MD5 d742f3872185aefd22b7211ca0806ff7
SHA1 76586636f78dc502bb0aa14728ba55035fb8db3c
SHA512 d6eaa2baaa440dac98d5d37e3f21ca6bccb355b6a6caaccbe4bf661686c9789163665f9cc3d8c51f060441d30b20a4cacf25be90eae022ff2e8a2f9e194bc727
SSDEEP 1536:t0kclrJklcc8vhKqjayKWKFxg7niIry56owbpic+trekk6Tz0KD9rBl1:SkclrJklcc8ba1WKFK7nib58KprBl1
MD5 SHA1 SHA512 SSDEEP

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
130	sites.google.com
133	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1244	msedge.exe
1244	msedge.exe
2056	msedge.exe
2056	msedge.exe
5864	identity_helper.exe
5864	identity_helper.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe
2056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2056 wrote to memory of 2936	2056	msedge.exe	86
PID 2056 wrote to memory of 2936	2056	msedge.exe	86
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 4024	2056	msedge.exe	90
PID 2056 wrote to memory of 1244	2056	msedge.exe	91
PID 2056 wrote to memory of 1244	2056	msedge.exe	91
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92
PID 2056 wrote to memory of 4588	2056	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d742f3872185aefd22b7211ca0806ff7.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd415046f8,0x7ffd41504708,0x7ffd41504718
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6000 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:5944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1728 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5392 /prefetch:1
  2⤵
  PID:5156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,12901675606101391180,4895490208336089544,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac
MD5 47b2c6613360b818825d076d14c051f7
SHA1 7df7304568313a06540f490bf3305cb89bc03e5c
SHA512 08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c
MD5 e0811105475d528ab174dfdb69f935f3
SHA1 dd9689f0f70a07b4e6fb29607e42d2d5faf1f516
SHA512 8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852
MD5 SHA1 SHA512

Submit Download

f_00000c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c
Size 20KB
SHA256 e8914e720a0f88c352b4277f42cb4309bc3184c4847ff66eaae450a48cf07a9f
MD5 7495f57473662645a5b2fff9a05b72e8
SHA1 a9d94e4b2f43ab30df0378a3b656cdd23ce857b8
SHA512 75a70c662740227cc50c6ded947bf667f667ba28b57ffaeb133a3b37b261488ae6cfa688561d78308a13f09b544b78b4b471193c202b44b1b2e3b6f08963ef32
SSDEEP 384:uCRvYuTan6ogpAEq9Z9/KglNEvPm6rvcmek7xKsyeErgFjthjDpqy73ZiloHozrU:uwYeEP9Z5KXe6r0peaeE03hjDMyVQ+oE
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00000d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d
Size 44KB
SHA256 19b5e38ea10f052b4e709990c7bec4c7b97a4fb061f28bcb95b092b753d01d7d
MD5 c836019fecc97d15d849325875cabb0f
SHA1 ee5e11847241e6e8e4d4aab3131117a41c37ede1
SHA512 93c37c4236f9a5e9a096fbbe25d3a7e9977564d280f1afd175d0016c7334b92d994d32c91f2bbac87ce91843f2388e3048f46ebece7ed5db9d8aeecc681475d8
SSDEEP 768:MkE4AGEpG4kLw0JFZyemOvjra4QvXwsqbCj3h8W7ZH1/e9h1qBCPzSN+GMZUdpBr:MkETppG7T3ywrJ+ZqbUaAe9XPWUG8UNr
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 470321c18cc7c23d5f640a73803907fd7b82cc6790cacbe3c32ab1cfa6ffbe72
MD5 1ca21ea585633a7cf6bb7f8f95f4e8a7
SHA1 cb6cb12ddd03c4d6a94d2ac1c7eadcfcdfef4f9b
SHA512 d0b87b56fb21784ac65d4fa9a3d8a5d11655ca65238681a045095851bc6a9fe64aea052cfd7636f410a8d289404bbd8117469a1807840df27b24c7e8ff52ec10
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 12c36453963f3416908987f2b165922722d5c449c623a8cf4b7ee9b5f3b3f4b7
MD5 f231ca3199057164a7fd517a2b36d4f9
SHA1 6b0584e6fb63b974c336e48f5e3827974d568579
SHA512 97ee6c11dd73f9bc7ac7057397abd9c07f20a6ab3a169e0a43f824798cd54eca63fbef2b21652fa0dbd12cb064bfa39499d08f099885b1ee03d74d436af77e99
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3aa9ffa07ba3bc7fea0726294d4aaf028501450fd0391385fbde79b46293085c
MD5 71ebd3cab844cd777de74d51b038352d
SHA1 e3efd17041a00edca30ebd000d8c71a5f1d954f5
SHA512 79e7c366970dd8d7d52de702de91688761d0116454e2073607f965f6c91d1476ccb1d4de040e332d95f633ceed093a2014c5e0d6bdaa7946460177b9a4de0a6d
SSDEEP 96:n6tkGKd1KUwpvWMoiVmdeH0QW5aqUWQyV+VD7ziEwb:n6tk/dwUGWMXo5aqrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 86fba528ac7c7123d141205dff28b0df2c54630552de21b86e369d93dd011873
MD5 1c3091918b5ed62240e6dc90d2a040c0
SHA1 4f4e100cc1912d8564de47116c12133cd864195f
SHA512 c83f7592054e1298e0da211d63ba34b065ac048118b3436919744814c9f8ff9a74267acff8b0dbb765de3e94e6b0651268df86dc70adde8cd913ea63bc56c28b
SSDEEP 96:n6tkdKd1KUwpvWMoiVmdeRs3LMT20QW5aqUWQyV+VD7AiEwb:n6tkQdwUGWMBs3LMT2o5aqrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f7667b2c88fed47486bc8637cc4150df3ec741837c239bfae88d7e6dfd8bd3c6
MD5 b37f8e42e9604f59465419541b1a4e82
SHA1 deb24c34eaae0c091dfc22de415650515fbf748e
SHA512 51a9b28c465d94e8c6eca373532811be8c80f9bbb040449790291ccafdce89813ae3b0e9375f17a1e8cb8edba97cca4d7750b01f8b6c22ed6c3cc4964dd9c17f
SSDEEP 96:n6tk1Kd1KUwpvWMoiVmde01Tgs3LMT20QW5aqUWQyV+VD7AiEwb:n6tkodwUGWMEZgs3LMT2o5aqrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 370B
SHA256 dda60c4a7ab33dc6baf577c28790d40c3cb86ddbe0905dfc3d2b4b49fd947d0c
MD5 998d9dc1dc3a3ae771d9dad1645657dc
SHA1 ac6b5207d2ad6bdb11f7560d59c3eb742ddbe9bb
SHA512 968f2af3015c0236728970c6443612408d7083d55465cb87544879c9cf2ab5531f39521aebe7e670da6a53797464191ebf2ea80a1a7ea01ffffecf4d470da58c
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d5de.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d5de.TMP
Size 203B
SHA256 b2070e4b7da65bf5f95b931bb3c23d4b4da72bc81f9cc314a8a61cb511e2711e
MD5 1a76e63aceade4232583ef4b38d65f5a
SHA1 bfc276ded1344a688227cc760ebfe2e354224c8b
SHA512 422bc06d2b3183bf8a07b87ec6bffdea23d0da1733eb6a3396a1dd0b1a2902bc2739bd2ba8dcf22a5779e91060c52839b0189bc5e881148b459aeb0fef86b5bb
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d3498b74f7de7d0a1e6ed141c3285724b69add15fe2705e4294f80b9b9e6fee2
MD5 536e374224fd2660b508ae3cc86de1d0
SHA1 98603f3612560fdb961ff03d5c73cd8aacccef1b
SHA512 223dd4cb53cb82aa8906862d8eb56b057228c4633b29b14aba94d1605660c7c4570abbb4c1af8c3c3ac988ac32d9d3f05dfe9294607144c415563e1ae948b62b
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupsYmge2RUM1FxbXrd9xUX1u:A9iIxuERzA83h09RZxYy+p17rd9E1MeS
MD5 SHA1 SHA512 SSDEEP

Submit Download