hxxps://drive[.]google[.]com/file/d/1DJewb1_3bQR3RytE-84jom7JCUX91RVh/view?695

Resubmissions

10/06/2024, 07:13

240610-h12q8aec996

10/06/2024, 06:29

240610-g9a47adh736

Analysis

max time kernel
99s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
10/06/2024, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://drive.google.com/file/d/1DJewb1_3bQR3RytE-84jom7JCUX91RVh/view?695
Sample240610-h12q8aec99

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
7	drive.google.com
10	drive.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2508	msedge.exe
2508	msedge.exe
864	msedge.exe
864	msedge.exe
4440	identity_helper.exe
4440	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 864 wrote to memory of 4884	864	msedge.exe	81
PID 864 wrote to memory of 4884	864	msedge.exe	81
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 1016	864	msedge.exe	82
PID 864 wrote to memory of 2508	864	msedge.exe	83
PID 864 wrote to memory of 2508	864	msedge.exe	83
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84
PID 864 wrote to memory of 5260	864	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://drive.google.com/file/d/1DJewb1_3bQR3RytE-84jom7JCUX91RVh/view?695
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff427246f8,0x7fff42724708,0x7fff42724718
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2276 /prefetch:2
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:5628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,5735155616265968828,9953324864732579121,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:5620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3344

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af
MD5 ae54e9db2e89f2c54da8cc0bfcbd26bd
SHA1 a88af6c673609ecbc51a1a60dfbc8577830d2b5d
SHA512 e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23
MD5 f53207a5ca2ef5c7e976cbb3cb26d870
SHA1 49a8cc44f53da77bb3dfb36fc7676ed54675db43
SHA512 be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 408B
SHA256 da11179c9242ca16a3c6a645a9ceba03a286403091c671ba76575639c7972027
MD5 b8e7e65dd18e6c7a282f34879e325299
SHA1 146dbda213fcccee976253157232b635f7d2195f
SHA512 9a44e033fcc018bd229b4fd8d9f20a4e6d5c1d030419688d2c6c063728333b88c957ecc73b24dc89657f539b027a765633fab5b99f42ea92eb8daf9dca218f1d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 79514a19eb88306e030bed8f13a681eb56dc0a1b3b772aa299b8f7af6a8d89e6
MD5 404eecddb753120db623bac7e29a4d71
SHA1 9a64975bf47bdaa6265e31a6bede865b57d32bce
SHA512 df971a717f1ab70bbb2c0309e5c39815a8a7c98350b755177533a4fd2861129a1e14c0aebe8e566850f5ad5bde007f17bbaf0f0d067225305e6c57ec89ce97c2
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 74fa8992308eaa271d5c5d61013981cb6194893dd0573f07d6d6896b86476a0d
MD5 7b126fe5a6888c22ff766b42e88c2644
SHA1 a878b1a55ca12fd0f582a16cdd0f94c7342ecffc
SHA512 34a09480544ed7f684dc930d305ab1faeec24dc6a796a29588414ce27e5773031b50e1c70897c7a12c60e35d0e676c1cdf4cc4cd6bb5de60fe7778188d3e28fd
SSDEEP 96:nNkmsQLUY1zofe8wpvWMoi4R5mdegwBjwchXOqpw8WZA8+UWQyV+VD7AiEwb:nNk0tofe8GWM4KwBsch+qpwa8+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 e7a9ae92ad8dab680f1efebf471d0532a87a2c4980c90319f08190ace5121971
MD5 bccbdc3f5823750765cd0c95e4e82b94
SHA1 b38e5098c72cad8dcb8d7ffefc0867b8883f18d2
SHA512 f0c3b60041c242035b1fee16a29248ef16d20a76755959a2511234361803fc3ed5d649d3e3da7b22c36d64cbd284f76f92e09e6319bf0ca312defde1227ae00f
SSDEEP 96:nNk8sQLUY1zofe8wpvWMoi4R5mdeWbjMFdVchXOqjKIw8gZA8+UWQyV+VD7AiEwb:nNkStofe8GWM4AbjAVch+qjKIwg8+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 8be28b5461178e58f9a3e87f31ae2a4c5edc3fb0a1d6e13404ae61ad6c6df63f
MD5 8c6d5d27f4e03fe64a0b352f48f3d8c8
SHA1 58ba675451ab1a4f3bae1c1f95ffe4e899e308c2
SHA512 58d0445e1cc419f111e531b38f8cf12aefbb526e6afaeebf2f6e9d25c2c07efc917e8f833b45d11fb09c937f85adf36a671b2807b58dea84529907473c5de171
SSDEEP 96:nNkcUY1z8fe8wpvWMoiVmdeHpw8EZA8+UWQyV+VDCziEwb:nNkKt8fe8GWMXpws8+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9df196e70b35b3681a29a4e4dfcd7ea6e4df96918e9c5304099568c7dd061bec
MD5 0fbf47c5cd2d21a315b5b7d80a323851
SHA1 86fe38e9e50291a7b5d3b233df454211f309faef
SHA512 076db0dbe7a4b6b397c75b18012d3bb7bdea87687f7f564aedd0729e9bc216c1dac096beca25f2cc44381a347eedf447acc9ff3a921195b76475ac4913ced57b
SSDEEP 96:nNkLUY1z8fe8wpvWMoiVmdeguC41cqpw8NZA8+UWQyV+VD7AiEwb:nNknt8fe8GWMwut+qpwF8+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0449e9ea3bbf02b9c174c5efb6c0679a03bcf243cdd4c7600fc3990e523b0a03
MD5 5ed0c16f5a05f2e7a2d91a95c997574e
SHA1 9b1cd1a69b3cea18a46672ab85c4179f09d2fc60
SHA512 275a20cc54a7ac5085888716ba73356e2acdbf44bf9564e5a09cd63b41016c40b9bc8c7bdc7a1acca509af1256762409853628248eaa0fc1c21f625669ccf70e
SSDEEP 96:nNkpUY1zofe8wpvWMoi4R5mdegwBjyqpw8lZA8+UWQyV+VD7AiEwb:nNkdtofe8GWM4KwBGqpwt8+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 85a240e59c780a4bbbdbf7fb6773989f5426418cbbcefba3cd999df3eb525089
MD5 0a8bc882ddd819c641d82c3a7a00a314
SHA1 25693a29e46eaeb34d8a6c2c80947dfa6cb2e66b
SHA512 d53af52461367dfa9d685e94aed5c7e504414fe5353c62cbddde27747baa354e26cd7fe72924032ac238bc1c3c010abc120a7e0b249324ae05b5190795ad0e8e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 2828fed5cf438dfcf1a992c54c38b111074b0deca42c230a47a93b745ea99c90
MD5 3df628432ea7c34c06ea6c1a7dccdb20
SHA1 de3c77cbdffb5d73dc474bf5c5e950be6e8d4d86
SHA512 4b0d01c9cd0c9a24f626f22e51ba2f2b3978fa50ceee39825251e7f2977d148cda9cd144d7e691fb6c2220f539bc0b3c745aff98237fc7e7bc17cbeac9948e96
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57b66f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b66f.TMP
Size 1KB
SHA256 15b6b427306bbcc8895a7b706f89a60985800b810e0334c7f6b254313e16a1ed
MD5 98975ec02ca480e616c3701b8612be12
SHA1 0ed1e60fdd387e69e0f7f5abae0da7295fcf4b9a
SHA512 ff666faae610b75e8f8eab3b02bd7e84ffbf0c05e08f0eb33ed6f13b1270450e54fe2ddac1625eb8ebe77ed49944d9bbfbd5e3bd7d0792b53c6ac9f48ddfd64d
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d49596127b2048efee54736adee6a270e704e83be05929529351d31c85257dc9
MD5 a0a980d32845751d0612d67184617c05
SHA1 54b727766422dafba2dfbd85a47c3bebe57739df
SHA512 3a4af8e01b06dbdd65ee827b5d296cc6dbf6be2f61cba21deb56d914168445c8e998eccd4be93b986c9e1632a4e5d489e291b12c43542be7e38b2254cb91f173
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2MRe2RUCJ+kO3z2OMDCRHB:A9iIxuERzA83h09RZxY7lOaOMWRHqlWj
MD5 SHA1 SHA512 SSDEEP

Submit Download