hxxp://inail[.]sailportal[.]it

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 07:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://inail.sailportal.it
Sample240405-jgxtlaef2s

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
3008	msedge.exe
3008	msedge.exe
4908	identity_helper.exe
4908	identity_helper.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe
5096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3008 wrote to memory of 4016	3008	msedge.exe	85
PID 3008 wrote to memory of 4016	3008	msedge.exe	85
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 2632	3008	msedge.exe	86
PID 3008 wrote to memory of 1368	3008	msedge.exe	87
PID 3008 wrote to memory of 1368	3008	msedge.exe	87
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88
PID 3008 wrote to memory of 1972	3008	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://inail.sailportal.it
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9fef846f8,0x7ff9fef84708,0x7ff9fef84718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5444 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --extension-process --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=ppapi --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --lang=en-US --device-scale-factor=1 --ppapi-antialiased-text-enabled=1 --ppapi-subpixel-rendering-setting=1 --mojo-platform-channel-handle=6024 /prefetch:6
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,8519591140565367609,3998257360370345627,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bdd4adaa418d40558ab033ac0005fd6c2312d5f1f7fdf8b0e186fe1d65d78221
MD5 7740a919423ddc469647f8fdd981324d
SHA1 c1bc3f834507e4940a0b7594e34c4b83bbea7cda
SHA512 7ad98d5d089808d9a707d577e76e809a223d3007778a672734d0a607c2c3ac5f93bc72adb6e6c7f878a577d3a1e69a16d0cd871eb6f58b8d88e2ea25f77d87b7
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0ae5cf8b49bc34fafe9f86734c8121b631bad52a1424c1dd2caa05781032334a
MD5 9f44d6f922f830d04d7463189045a5a3
SHA1 2e9ae7188ab8f88078e83ba7f42a11a2c421cb1c
SHA512 7c1825eaefcc7b97bae31eeff031899300b175222de14000283e296e9b44680c8b3885a4ed5d78fd8dfee93333cd7289347b95a62bf11f751c4ca47772cf987d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 20823b2575d5f20a8241fe0fed27f9d961484431e45256b58aa110c20487c827
MD5 331e332a9acdd37cc5c2e2d29dee560a
SHA1 daf182305db0551d5adcfa434ac0e4e0d9707f80
SHA512 9fa8a5897317dca4fda1664feed7e4f2ebea8995ebf150898161a4e0dfaea0cb26eafd616eca61614610b4fdab58afcf81124195242e730f6bd2f26dfa3655d4
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 555d92f083c92d5b8da82dc04c404077592241895cc42b252cb6108606abe39c
MD5 376fdba1f5d1d0f98acd0d840b9d0e99
SHA1 c58d5f9e4caa9f88a21bf8b2e55a79c8020c9657
SHA512 e4a8a2a51224db269c00d10ee59c3a3aa3d0b8b30dedd95e139b6a8870162dd59824ccddd63197ae1c63f3d85714ca4db9a1dbe7da7d460ef8340bc9f34d93c7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 d39e16f82d0bf9997d7dc3101b5d035b4bbfc535f48ef5f9cb55f360a93388f8
MD5 2429f244a4debcbf86441843df5461c3
SHA1 c7d3a8cc76451cb1752f399e8d6fc05aa9f5606d
SHA512 701c01ac5b4d87dd5dae6d66c0a445af4527c1ccf70c493473b8a41e10947c98e32b11bdfb9ec2534703835f1a6d38bb9439abc30e874e0084cab4f65f9793bb
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 7fecdfc8e8a4ec02245b878668ffb53e2289fdfd58563d8cf510c913b4a46204
MD5 0a59a764f1a8706bc2345ae5f225cf65
SHA1 c7ddc93bb9c77f8fbccf8526bc2b83e8aeacab81
SHA512 cf855cdec2a25bc8ccb33bc5319fb84012195a4f1a81a805e2690baeda27a7aec34c7269b9a4100e958f306879f1fd6bdd5006635895954279d465c3c54cdd44
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 b3984f5a0e580dcf9f569839a30ed9ad03d9f952b2092e6d8d9435eea53c68e2
MD5 26dc4c4708be92c23751723351655552
SHA1 3c8035b9fe5071fc815cb83f46453e0401e01a3e
SHA512 6a358ad3986a3833936c557d847b90483091ecb4d4164aed426adc2fce8b5d6c388d1acd52d80d7d29c847a1093ed07fade620854386d4b50cb01d862c10d3a4
SSDEEP 96:ntk4VF12xNOh8lwpvWMoiVmdeUwbjeU4/ja+q+GweUWQyVeeO1VD7AiEwb:ntkiENhlGWMkwb3G++qNHrepN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 96fced6c1851d4501aae6a59578c2ad5216df9491feaef2c649ae3f52c4ed1bc
MD5 7f1651a0e7e2105451895c8e726f0a62
SHA1 0578f8abd594ca62e9e00a508c055d56f115debb
SHA512 52e91e21396fa664bf72559639387348ecf734b77953ec3190cd823b88ab49f5bd87ed178e3b0019b510708fcaab63b75b34131b46fec6b46bcc333ead3cd038
SSDEEP 96:ntkyF12xIh8lwpvWMoiVmdeH+G5eUWQyV+VD7ziEwb:ntk2wPlGWMXNgrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 cb9ab5527300d52f5efc201490ddd0c5903130f7b2f4d8f7d3031b11a51e5823
MD5 7db6edfed5de865e1b4598bb101ca6d0
SHA1 4bc6ff3e28cac225b386c83ec29fc440d8f063f6
SHA512 3d702a333e6bb5b9e1e5d36f50afa623eb1c350b9403ac27ffe3cf1b05177b7fc9860291679ac6973c8e82d062370e5bdf5ae86cfe13acc4eccf1c727133de20
SSDEEP 96:ntk4F12xSOIh8lwpvWMoiVmdegus1MKJWuePq+GteUWQyVeeO1VD7AiEwb:ntkYwFPlGWMwusd8dPqNMrepN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 f06617ef220d3241566be17b9842a471191fc391625f63d4dfa0e83146204871
MD5 c9c3bac46025f907fed289329dfbac9c
SHA1 12fd9c5f9dec92dba0270b54e76bb7098753c22d
SHA512 c684c4f259edc8fc0dfecaf358f24a1eadff9a5dba464be9e0553cfc7cdfab38521947cfc8c1b62d9995786eb4bbde7fdd6fda201705858fa1d5a3f36e0be862
SSDEEP 96:ntk4VF12xNOh8lqpvWMoivR5mdeKbVMF7U4/ja+q+GmeUWQyVeeO1VD7AiEwb:ntkiENhl8WMvAbVZG++qNFrepN
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 d0a6a1c81336aa493f872ff0578b873dd72fb60430b2e40565729507607fb1f4
MD5 c634f04b91e135d8f9d37a0b781381ec
SHA1 2fc302ba2b66c2c3fe1244b78520c4b934c2adf9
SHA512 5ec47b08ac3a65414abdd834439bfe6b5f6ec4390e26e65258700361f6d6c3c9713fd7a498b8ea14decb0a335402e54bf69c8de9bdbcfe6cd00fbf6c0be2c7f3
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 fa91be33b5bdd4ac1787bd7cf7abb06409e4dbd11486b27870850bd040e1930f
MD5 cda1ca9c0a4dfbd06cd16714184e7a4b
SHA1 6fb4809f00a9a957770f1d1f5b735f350042dbb1
SHA512 8b6e0c222cc7e149de08d61dbd2766a4d09160393d8c666ac978aa68815dcd569f1fad2ac22b6e774816392b26262e8483fb179f97c6a36c8ca04c44593a5db9
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe585d00.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe585d00.TMP
Size 1KB
SHA256 2c5dafbeca0907051eadc32e070844e5f3e7cb04865b8ca939bc21cba1ad42bb
MD5 128e28da816edfd204e15990e0ba9384
SHA1 d3bf3546a2bf263aa708c798dd999fbc1e5b541a
SHA512 03e78c9cff472cac7bbcea6df02c3c1090e3f71a28a4e5b352c1ce064e33ef76053a9e3313bf5a84ea2f28836bd82e5400f333536a327827a4622246ff0cbfa3
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 978e9cc01ab33a354a9595c0125469eb91fb1c562b611a68fe30eda73aa921db
MD5 62353859bb93277e561e1ba7eb856d74
SHA1 76afb670e0e0be262d4a19edb211c1d78466d6cd
SHA512 cad4abad1fef351533c926eebf909472e1ff78d6a91f3752206f79d80e6ef1a5bb5fa7b6f28c858502515a29ee43ddee76d03c03b995d76c7062af3f0075925d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxe2RU6zebgaxvFt2pTEEjT:A9iIxuERzA83h09RZxYl3DaTt2h3CoD
MD5 SHA1 SHA512 SSDEEP

Submit Download