d2c736fc70a887dda619b0098ee25efbc75093bd7f4d2937a08e70be8e66f1ec

Resubmissions

24/03/2024, 15:56

240324-tdd77agc8w4

24/03/2024, 15:54

240324-tch5rade983

24/03/2024, 15:47

240324-s8k4jsde857

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
24/03/2024, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Ko-Fi.url
Size 122B
Sample240324-tch5rade98
SHA256 3c66f3c1f575e486fd6ff50405a53974cec3d8e9badf4d7cd9c045a23ff9658e
MD5 fe014b77eeedfabab4c600fdc4b187c9
SHA1 ca7966ff9b50db38f12ac20c993472a843dac90f
SHA512 e72b4995e4afb1021957b5adfea3f14c14ab487410d974e5088136c9b98f194c27c75fe440812cea73d0e785230782abcb6f829c0a6d3f26818719ba98070d98
MD5 SHA1 SHA512

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe
4896	msedge.exe
4896	msedge.exe
4284	identity_helper.exe
4284	identity_helper.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe
2080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3468 wrote to memory of 4896	3468	rundll32.exe	88
PID 3468 wrote to memory of 4896	3468	rundll32.exe	88
PID 4896 wrote to memory of 3576	4896	msedge.exe	90
PID 4896 wrote to memory of 3576	4896	msedge.exe	90
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4688	4896	msedge.exe	91
PID 4896 wrote to memory of 4932	4896	msedge.exe	92
PID 4896 wrote to memory of 4932	4896	msedge.exe	92
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93
PID 4896 wrote to memory of 3688	4896	msedge.exe	93

C:\Windows\System32\rundll32.exe
"C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL C:\Users\Admin\AppData\Local\Temp\Ko-Fi.url
1⤵
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://ko-fi.com/jepricreations
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4896
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff274846f8,0x7fff27484708,0x7fff27484718
    3⤵
    PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
    3⤵
    PID:4688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4932
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
    3⤵
    PID:3688
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
    3⤵
    PID:4468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
    3⤵
    PID:2620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
    3⤵
    PID:3232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
    3⤵
    PID:2964
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5644 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4284
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
    3⤵
    PID:4320
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
    3⤵
    PID:4592
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
    3⤵
    PID:5436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
    3⤵
    PID:5444
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2008,1879587111403384812,15449966381643547396,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4984

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 05e80abd624454e5b860a08f40ddf33d672c3fed319aac180b7de5754bc07b71
MD5 f35bb0615bb9816f562b83304e456294
SHA1 1049e2bd3e1bbb4cea572467d7c4a96648659cb4
SHA512 db9100f3e324e74a9c58c7d9f50c25eaa4c6c4553c93bab9b80c6f7bef777db04111ebcd679f94015203b240fe9f4f371cae0d4290ec891a4173c746ff4b11c1
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1b53367e0041d54af89e7dd59733231f5da1393c551ed2b943c89166c0baca40
MD5 1eb86108cb8f5a956fdf48efbd5d06fe
SHA1 7b2b299f753798e4891df2d9cbf30f94b39ef924
SHA512 e2a661437688a4a01a6eb3b2bd7979ecf96b806f5a487d39354a7f0d44cb693a3b1c2cf6b1247b04e4106cc816105e982569572042bdddb3cd5bec23b4fce29d
MD5 SHA1 SHA512

Submit Download

f_000026

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000026
Size 197KB
SHA256 15fc7a054efbb9f76d937448fbb4814d7b3f25a6d137e24c1a69e32947eae71e
MD5 5e28e72b443ded036a4cf369d0dda3bf
SHA1 0500de4480a54243b12d096745c6ba04c9479e66
SHA512 7d17a5248e54e4dda8fd17a4d662edbb274629161a1e25b3b7f7f5112541663a5040788177268c53b2c78bc7e6d2204ccfb342d93c2ceec0a12d8a41788c088b
SSDEEP 6144:O7+wum67B2lueEyG+gvJbJEOE2nMWdqNBSiPPdsL:OXlgeEyXIbOOE2nBSBtHmL
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 368071e0618f815e5c5c7e9f31be1b3b59abbd98f95ab4c9e319b935fce2f7f6
MD5 3f1b2ee2eceac8acd637d848da168a7d
SHA1 0357716e8c42646267f78998899c5eed8f7d647d
SHA512 75e5675039b539842ddbb78ef0dd86eceb6ed50f868c08cf7f68692332a1f28a8a3b274a57aedf5212686081dcc3edec58b9c0fa5935ca0666c19184657d38b1
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 79c45c2c5bcbe543faa78dffe865647c9bf24e7b02a3db9953eb220a8479c67e
MD5 07149c915bad4eba99019e28586e2ee4
SHA1 23218323ed14c7b4a262889dbd6504ae2a863ad6
SHA512 8bdd8675bf95f5dc0e93c6878a1319d232bb2b26dcb4f87328d38802442636bcb67b4e161034605b8ec1b331061542a3446eb687f9c9855858d72606b9cf1cb6
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 10abcf7f226814da8003db3f7bdcfaeb5a76c8898dcad36c4796fe4e67730a6b
MD5 151ee90f7d5396fdbf67a2d53e5add6b
SHA1 16d84152168dc526d7bf0dd0db04b51ae29c6bfa
SHA512 dc317e3d9f33bd55747a6edf581d9735d7c5b483bf7aab1400eed754b6ce6305938d3654fb72b368e74a57a9ecfcaddc512eeb971b68ee6ef33b00c18b572272
SSDEEP 96:n63kDKj1S/SPwpvWMoiVmdeHKaOWpoUWQyV+VD7ziEwb:n63kOjQ/SPGWMXZpport
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a6adede34bae7826ee45f06c1e807df47699c7a71773ccf7cded9ecab506e1b9
MD5 892c19cea664e397dc0f4403205525bc
SHA1 d9de17930ca015bdaa3ceedfd07b8734edaae6a0
SHA512 aba6e95af12ecb873f08b7d78844dff67cc480f1692e122ccf57cf57e932f4521f0a1059e870e052538a43e8edfcdcdcf1ad81bf22c9b89c13b58a05666410cb
SSDEEP 192:n63kcjQ/CPGWMewuR2O4SM9Rh2Zruporg:n637jajWFP2rN/CrupN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 0b774dae2d6ea20a4b557cc11c490a2c775b2c3d7ebb5ebb6c8ebee56e302357
MD5 ad2ba4c3a0aa4088ce3bd1ff89d9c513
SHA1 f1599d00a6dcee8e4dfd870f08d92ab4e18bc8e5
SHA512 025b6746fcb267775842455e087892466ead994a8e34338642fc069edb28af78fb9d33a45d1e1498eb8671b9e604548d2af410d1782cdcc42cf69a6a4c1a557f
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 3ea9eea187a0ffbeb7755680287833abbc5945a5f72358d415d2d5dd28da68ca
MD5 561ebf6fa951aae9f222eadf559c07fe
SHA1 3147036c4f8e05a831fb7e409d486ecfc6cbbf33
SHA512 04eee92b08198f1537c233c6811f50b15d5408a52c1daa4f1dc72ade243231f5d9ed704068fdc211d9196a1fce0b669873e766da776f71a6e156f75c9b944e61
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 708d18befcc52dbd02c0c985cf3b813f578d888a712d29e9c378f90a59456527
MD5 98c489cf0f86452f14de55e65a250ebf
SHA1 4e731d8ca08901beac8f92081980224254a00421
SHA512 2d17d26e8bf6d72333306a9bdbc4967af5daf661fc0405331676152652105a452775621eb7914f4355d37d243de13b92c6801fd056b9b15122537c365e798bb2
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ae41.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ae41.TMP
Size 1KB
SHA256 51f0373f516c3bd760aad061cee6456ba2b508ad3390f968405630dbd1f7dc82
MD5 e144ef039f12ed9d0cc8a62dd01afc95
SHA1 e15a76407e94f73b24f74fcff288e36d81c7e0af
SHA512 7cc4fd1758a19e8b20892cc4f8d091c4ad741b38e4900f46df99b4f5c17f18907a95ead00030bb7dc8af66f4d187a7fa20739b9c540f738d8ca768ef9d687f70
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d77eaf4cefa0feb719dee99db119d02a0722f9f68db69c079dc65227e329ee58
MD5 39bddaf4a2b512c169c6ca41146630b6
SHA1 1ab22ec3eaf70feb58fd24445aab5ec2ce9e15e0
SHA512 6640507987a72e780f2c7e70ae20bd052bab8dc08d47b7b7134049e245ee0369d8c7aa725cb859b9130d95ec06ff61970feb9a1295e8234429cc530e3ce676fd
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTHhTxe2RUMe7KbEr8IQJU7:A9iIxuERzA83h09RZxYTRlpefr8IeEX5
MD5 SHA1 SHA512 SSDEEP

Submit Download