hxxps://u8387778[.]ct[.]sendgrid[.]net/ls/click?upn=u001[.]VEsWrlMiJDg0mXafq1mEXWtRp3aoWox5SVIqq7txaCsW2pyDRGEovvonvZ9c-2F8lbDK-2FwxHxQgHg0Stuez-2BWwSIa-2FCw0LLaR8Jyr5DM5mljpZGJ7Qp7aj2E29EtO35ChU7r90xd8l-2FwJG37A2hIkM7g-3D-3D641x_b6doHCXnKL7z67a4tsb8Eo9ezcgl8AGz0upYZ-2BaxlUgGyUJpXR8PYdM3Idl1ceZFM8xbm86DGru62-2Fg8gQyoKiaL3oH0fXJasy9jiz-2Fweep7pLy6qc9kfeFNJe7B-2Boe91419NdYpS63gCwN7HW3Q1ofynk-2BSwWXPUzD7WT6tKf9k9D-2F5dhwuxqy-2BIFVzSh7BIVRva6gnS9aw4eKdLNBmVA-3D-3D

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://u8387778.ct.sendgrid.net/ls/click?upn=u001.VEsWrlMiJDg0mXafq1mEXWtRp3aoWox5SVIqq7txaCsW2pyDRGEovvonvZ9c-2F8lbDK-2FwxHxQgHg0Stuez-2BWwSIa-2FCw0LLaR8Jyr5DM5mljpZGJ7Qp7aj2E29EtO35ChU7r90xd8l-2FwJG37A2hIkM7g-3D-3D641x_b6doHCXnKL7z67a4tsb8Eo9ezcgl8AGz0upYZ-2BaxlUgGyUJpXR8PYdM3Idl1ceZFM8xbm86DGru62-2Fg8gQyoKiaL3oH0fXJasy9jiz-2Fweep7pLy6qc9kfeFNJe7B-2Boe91419NdYpS63gCwN7HW3Q1ofynk-2BSwWXPUzD7WT6tKf9k9D-2F5dhwuxqy-2BIFVzSh7BIVRva6gnS9aw4eKdLNBmVA-3D-3D
Sample240528-12pgdsfe84

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
4712	msedge.exe
4712	msedge.exe
3880	identity_helper.exe
3880	identity_helper.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe
3428	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe
4712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 1124	4712	msedge.exe	83
PID 4712 wrote to memory of 1124	4712	msedge.exe	83
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 4932	4712	msedge.exe	84
PID 4712 wrote to memory of 3096	4712	msedge.exe	85
PID 4712 wrote to memory of 3096	4712	msedge.exe	85
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86
PID 4712 wrote to memory of 5624	4712	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://u8387778.ct.sendgrid.net/ls/click?upn=u001.VEsWrlMiJDg0mXafq1mEXWtRp3aoWox5SVIqq7txaCsW2pyDRGEovvonvZ9c-2F8lbDK-2FwxHxQgHg0Stuez-2BWwSIa-2FCw0LLaR8Jyr5DM5mljpZGJ7Qp7aj2E29EtO35ChU7r90xd8l-2FwJG37A2hIkM7g-3D-3D641x_b6doHCXnKL7z67a4tsb8Eo9ezcgl8AGz0upYZ-2BaxlUgGyUJpXR8PYdM3Idl1ceZFM8xbm86DGru62-2Fg8gQyoKiaL3oH0fXJasy9jiz-2Fweep7pLy6qc9kfeFNJe7B-2Boe91419NdYpS63gCwN7HW3Q1ofynk-2BSwWXPUzD7WT6tKf9k9D-2F5dhwuxqy-2BIFVzSh7BIVRva6gnS9aw4eKdLNBmVA-3D-3D
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5856 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:5284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,9001655169323276645,9860960150223254873,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5636 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 600B
SHA256 909b4ccfafd3ed37d03529d34401493bd2c3f1f2270e01c64b5109c0138a180b
MD5 7111665337eeccd4ca52e5a0a9d2dedc
SHA1 020157259ff99536795a351dadb3d58e7a1b4ce7
SHA512 8b7b739ee03e43d69d831f193626676660006265708836f3ec4e2d3958b5d8df417579e47eb148ea828f03e74a23a8259e6a8af6c3f3598de5c7ba550a8a6fa8
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 503B
SHA256 96777fc0effecf21c7204af5e1936f53919d8f80d4d916e429ab71b1eb053c62
MD5 2c83acf50c8828168b54327b4cc9e2a8
SHA1 0e7264deb0aa7f3085134d7a3fc64d896f801bdc
SHA512 873fdd16d1f79d08a34313b0cec4790e2c8b73f19017f22c3687651afe607c8f3e1c3d59950ea5e4b72a74ab5ad8fa003ed9c1aae598b27a7d19a9452a621c2b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 683fe6c3124050e467288a3d8373f8bda12eed4273fcfd4a3eed21c9908142d0
MD5 e4dc919742a80ea0446e08345810d8df
SHA1 9fa0c129dc000d425c9991f89d48204a52839416
SHA512 56865688b66c43ac7cb56bd06d5200fbb556d75a2dd2450bc133115225d1c64e7c09ef3074eab6126078191e570fbd83016e6e7cc14cc149720653aead4e8b9b
SSDEEP 96:nk/kij1Y1wpvWMoiVmdeHBrzmUWQyV+VDCziEwb:nCkYW1GWMX4ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 35a2c64de3db85363f69d6b807e1181d3a2a21ee7e40a10cb0d0a14d7e58f12e
MD5 45c9534aff5f9987350ae0c40e89886d
SHA1 3ef568b872ed99e2372cacd5e0bbcf2380f30fa4
SHA512 54bb598b73ffbd916a908256c6ebd00c936b0e85142a916d0564564396d9cc69e34814f0440b261ed57825d129bf39f7fb3bbd38fab02abf0e5145cdc19ec0a8
SSDEEP 96:nk/kZj1Y1wpvWMoiVmderUux1jBr9mUWQyV+VDCAiEwb:nCkdW1GWMbUuxhKrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 e285453d7653120c6cfa8f3e31ee232eda780ab6aaf187df0e142102386ad8b6
MD5 275a523fc96d2eb0ad3940dc320deb8e
SHA1 0d54e85a2ded8ae45e24b65e41229cbcbcd34b23
SHA512 e4a8114062d48abca1aea74bb528597a3106be701249beadcdfe84f8ffab49a00191be8914b3d20a8d2496422a49bdfeefb83e8ce24df3c1563419ae45bbea63
SSDEEP 96:nk/k5j1Y1wpvWMoiVmderjwRjNBrWmUWQyV+VD7AiEwb:nCk9W1GWMbjwRpPrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 13df74fc50dc8347f9510da01a97db59ed91df409b7ef55bc602dde3853d69db
MD5 a761b7185e8ae942b1c3a5c46cb03b9a
SHA1 9a345e36875789a145b41406412c837bde9809ae
SHA512 5807e5aa613dc9e6799917ddd187a3b76092b34c4c2901c6c60aabf6e9bc35d6aceffbd02268a9a76c4860df3b2c0777bc4e77bdcf16dbcd5009e513f290f654
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 4a4cc2b2e76c89c1f0655f966663d7c7570bce4ecd9fb9c9ada3900341b22410
MD5 c45165d0c93c54fcbcfb1b71ecbb92de
SHA1 71a51e7da35eaf22cd054722e66b2da3aa337605
SHA512 2c26b29ce00a25b33c57e9b1fb97ec231ad62b5a05cc97331978acd081b0f33a19f0ac36b4175306d64a384b76bf441aefb42b283adad9f642ef6feca35ad504
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 b9152590d0c9c471f8dd3d1a4661ce9ce2ec5e09110205276e641f8bb4ec69e3
MD5 62ea17618cd498d1abe621dd497f0f55
SHA1 2249cf0eccfdb31b5cc22e7aecf862e138d798ef
SHA512 ef9535baa48392ef3d5e5c64174ec8951de65b25cae147a79153efcb77fce7cb67af575c6025d7f215638258eec2779520c3f4879397a007931ff66f38a4e69c
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 369B
SHA256 1b76439a0869363f153a25eb945e5f788a697dce1306dbdd507e82fa892bb4a4
MD5 7f0b531a2f9cf3ef95574912e3f85cca
SHA1 785d410c6b6d507c025341e3b0d138b3634282d5
SHA512 155ca6cddd4b844e3b7a077c61b00fd2ab16c87eb62a3a63734b0aa94db9c5114e0bca6e77487acdf32eec80454771c8a383752155f789b5b9b0ca1e35c2a45b
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe579a8a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe579a8a.TMP
Size 369B
SHA256 948f51030dc17733e9f6ff2c2c137429a40805cbe639648acf6936b6f7a0a277
MD5 35c51ff8c61bf9fb9d686676029d0bb0
SHA1 2a3a0ad7793f1c1b5db8b8fbf33b5f979716d4b4
SHA512 a196eb9b1731defd9e4b7eae29fa00ac4f32600fea5c5dda1b774f0894e8de4af02083fce117ea62ba2061ff9c1981e6bc7be2a267cfa7f29142afca441d3984
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 8edb827d7d5c33a31192d7b25143d396dc1c060a18eea51e73da46a8ba9e8f19
MD5 6ef3c19e620dd89dfabd50dadf341dec
SHA1 7013aa336f2133b437ca28e15b3c157b4888e394
SHA512 5271ab3bb6f3188efaf7b23f4ae9ef635ca33390de0b3b05e49f657546295795073b2b51418e0ffcdee25a79b321fb1c5ee01490d014ead92ad0528262764dcf
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGeHze2RUXMj2e3z2OMDCR5:A9iIxuERzA83h09RZxYZHjVyeaOMWRHZ
MD5 SHA1 SHA512 SSDEEP

Submit Download