992b0f530b0811cadea8f040f406d7fd7a476d0a59ea4704a45ca75c8b68ac2d

Analysis

max time kernel
44s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
02/05/2024, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
login.html
Size 98KB
Sample240502-prt4caha3y
SHA256 992b0f530b0811cadea8f040f406d7fd7a476d0a59ea4704a45ca75c8b68ac2d
MD5 4b605aba6e0c3663d0f6f0ed38a9f7d0
SHA1 21e737862d9932a56af2f108b315c04c76b14c19
SHA512 9522cce1522872c4533b638346b992c4bc7692c0e1b6828d4a826e195419419a4cd43afb411f25a1566971f3f7ebc1d34dc3f6dfc6b5e1e076109d09e0ab3f23
SSDEEP 1536:4Qdo7owMdTOKs/4yIUIX3vZY4VURyuCqiam5O7x1RBgowi8:4Qdo7oh8Y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3726321484-1950364574-433157660-1000\{E4A2F8A2-57AD-4E86-A3BD-4D82F67CECB1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3726321484-1950364574-433157660-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-993994543-2095643028-780254397-2751782349-1045596949-3142982554-3368930949\Moniker = "cr.sb.cdmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
1760	msedge.exe
1760	msedge.exe
1592	msedge.exe
1592	msedge.exe
2376	msedge.exe
2376	msedge.exe
4732	msedge.exe
1584	identity_helper.exe
1584	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 2380	1592	msedge.exe	84
PID 1592 wrote to memory of 2380	1592	msedge.exe	84
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1388	1592	msedge.exe	85
PID 1592 wrote to memory of 1760	1592	msedge.exe	86
PID 1592 wrote to memory of 1760	1592	msedge.exe	86
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87
PID 1592 wrote to memory of 3484	1592	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\login.html
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff855746f8,0x7fff85574708,0x7fff85574718
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5292 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=media.mojom.MediaFoundationService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=mf_cdm --mojo-platform-channel-handle=5112 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2208,4421241419645525474,17760090642632658052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:5528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561
MD5 2a70f1bd4da893a67660d6432970788d
SHA1 ddf4047e0d468f56ea0c0d8ff078a86a0bb62873
SHA512 26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51
MD5 fbe1ce4d182aaffb80de94263be1dd35
SHA1 bc6c9827aa35a136a7d79be9e606ff359e2ac3ea
SHA512 3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 f0057c7385a7dca0f7a03096dd0b34cd32ee3b0cbf72336745909f698bbf8c3f
MD5 5876d265bea33c02aeb931e88662cea4
SHA1 27b3bba1173c5b379b59881499892d9f8b483cef
SHA512 0823bbced79bfc492e5156a25e07c47d43d602d36e055477d642b097c951a61b6f61345d12a66b3dc88a2f1110fc1bd06e6ed35142d313721a15b8803efd26e7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3a29c881f6f8be6e390c858740b53d7126c3edc78b82af996b7cc9123811eb61
MD5 ab229ea5019759b07c70adfc504433d7
SHA1 676430e978cb9fbc382527586875ecc2c4be1f76
SHA512 cba4e718da639b16777f0549185dfa7b13d35021d0b01557fcebda14f517efa614cdcb3ce460fb6e5d9e23fd663320b60ed5b69f01d41e166c02dd8fc22ee64d
SSDEEP 96:n7ekPL+1m6niK1wpvWMoiVmdeHdt7SDgUWQyV+VDCziEwb:nCkCI1kGWMXb1ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 60c1431a67f6ceaf5a4e5b622093094f99324e5f413e4197596b6fce35ebfd75
MD5 ba6967409141f6a23ffef37619aa3e23
SHA1 a4d0315c5ef6ef606bb5ce09d39d1c67f86e8eee
SHA512 287f98e128b7caff4faff46caa6cb99345aa08a84adb0d3132f262bc1cc86b1721ef8b9ae1ff7757012a9078c30fd5b8ca373cb38e2b36fdde5a4e3fac4190f2
SSDEEP 96:n7ekqL+1m6niK1wpvWMoiVmdepGa72dt7SDgUWQyV+VD7AiEwb:nCkZI1kGWMoc2b1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 82f45d9f56234d4d95af9569d47d46f087fc834ecb1f33c66c24f4dcccbef888
MD5 d394eecdb808e4f8e39b2bfdbf62be52
SHA1 1ea47b5c96e6ca33a71dbfb518de07ff8961b95f
SHA512 2dc8677321da2b0aa7fc6565164141100e35478be1e0aefb7962c32f70741a2d9af7aa5cad33e4c184946242b76a74a3617d4237de48fb2ac8a51b1c5674943a
SSDEEP 96:n7ekZL+1m6niK1wpvWMoi0fR5mdepHv72dt7SDgUWQyV+VD7AiEwb:nCkwI1kGWMmLT2b1rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 3b8c91c01ba1268f6c843d2e9b2d20e7b6d2fdc2a7d802eb8c262827853aa41e
MD5 105347720486daafd764b4f6ff8d6264
SHA1 72188b6cea38007c1fcfebdcf01e48482993fd51
SHA512 c1a5c5721ddc765a62db62468e40df5ed96e53218a16aeb72b3fad1bee452e3b29baec6d5c0b104a206f6a8844aae6d3b17a5c1bdc0282db7586b1e6df6edf7c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 e26a5becbfedc2b068a2e843c311ed5de7cf4b9cf757fbc33af24e43b9f1093f
MD5 86e5f0d1d8ad4fd240fd01e270047c02
SHA1 9b2e17553b93f01c6063cde1f35a30c12700a8b5
SHA512 41416c0f7185261c3f9fdd1a2806a69b2c76e1d7868580067b237acf427d51d138d5dc2ef72a2d63e063781e2af2098d6e8dd3c70937a9a81ed676a0ee6cac2b
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57973f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57973f.TMP
Size 371B
SHA256 dc329ccb445c04d9bedefd7d3f83a470fcff1e24e4d1e3eb734501b4b74c0dfc
MD5 a898929a08c48df3fceccbbc70e95fad
SHA1 fce4c0dab79fe88feb24348818146bc53c72549b
SHA512 9500ab0c6b0bb48b165ffe6b35899a195a0236a755c4dfc12f8ceea68c8baf1dc90572b92057b213ac118dc5f7247c4a8e2058024cd7d616d8e257566c7449c0
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d00b565fde2af6d04d79bfb89fc9b5bbfeebecbc0e9e0fc9b52579428ad77ccd
MD5 39f530b1712b266b5e2bf32c90c0d6f9
SHA1 fe2959cd8b0d1412c5d83ecdc3b35d60601b959d
SHA512 34ddbe7c4fe87269d3261f6ef303de0925b697ff03975ece4fb651b42ab22e54b1c246036969991fbbee6ecd4f4e71469d7a423064e65d2052ed0ad6a9be4e88
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupCBcNe2RUvhOiH+OblfBhDa:A9iIxuERzA83h09RZxYhsjH/XDafEBcv
MD5 SHA1 SHA512 SSDEEP

Submit Download