hxxps://aquafish[.]net/pagecon/pagecon[.]cgi?no=13&page=hxxp://sliverstonemaj37w47y4732093bdjhefvfrwbli[.]s3-website-us-east-1[.]amazonaws[.]com

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
16/08/2024, 16:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://aquafish.net/pagecon/pagecon.cgi?no=13&page=http://sliverstonemaj37w47y4732093bdjhefvfrwbli.s3-website-us-east-1.amazonaws.com
Sample240816-tkd6rsxdnp

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
736	msedge.exe
736	msedge.exe
3516	msedge.exe
3516	msedge.exe
2056	identity_helper.exe
2056	identity_helper.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe
3516	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3516 wrote to memory of 724	3516	msedge.exe	86
PID 3516 wrote to memory of 724	3516	msedge.exe	86
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 4804	3516	msedge.exe	87
PID 3516 wrote to memory of 736	3516	msedge.exe	88
PID 3516 wrote to memory of 736	3516	msedge.exe	88
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89
PID 3516 wrote to memory of 2188	3516	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://aquafish.net/pagecon/pagecon.cgi?no=13&page=http://sliverstonemaj37w47y4732093bdjhefvfrwbli.s3-website-us-east-1.amazonaws.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa8a1f46f8,0x7ffa8a1f4708,0x7ffa8a1f4718
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3026185600108665295,2051349678606162860,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1188

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9
MD5 eeaa8087eba2f63f31e599f6a7b46ef4
SHA1 f639519deee0766a39cfe258d2ac48e3a9d5ac03
SHA512 eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b
MD5 b9569e123772ae290f9bac07e0d31748
SHA1 5806ed9b301d4178a959b26d7b7ccf2c0abc6741
SHA512 cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795
MD5 SHA1 SHA512

Submit Download

f_000004

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004
Size 209KB
SHA256 27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6
MD5 3e552d017d45f8fd93b94cfc86f842f2
SHA1 dbeebe83854328e2575ff67259e3fb6704b17a47
SHA512 e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9
SSDEEP 6144:ewpSHs6ljYg6trFqiSAprekukr20IgIgR:OHvhlo8XGus2oR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 a7535d489c9b9389bfc2637c06c71d2e9bafb4223d313d3e57643f1cb43be6f7
MD5 0fcc8a49dd6f5282e6ee40e51e4bad70
SHA1 3ba52b6a08f1363a40c53945b73c9dc81d32b96f
SHA512 c05d921608fd18d3d0ebf094e1123cb978232291e39ca868cc50dfdb640822469e21ee87f6dad037e1b49690a1e432ec093dac7ce8347a2e783cf4f4d72a00b7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 3554a046923169823490a8276390e183df44fe376fb9e41249b4fb0d1272c65d
MD5 67bbfefe51bb9a5326a097674cdb8bd2
SHA1 0c4f50bb3dfb63f788d1c74fc7a12a61f0fae4dd
SHA512 d9f0e2f80120ec7dda3ac7c12493ea3811875980ed7417b8aaf4f6e4d1e41a44a2173221acbfd005a1e78834db2d592db20ae9534b44c2efa2b42c1e3037954d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 782a42bd89ce81d83c73e92e7d06e7f720092699fdbe4ce503b83e6d9f4171f0
MD5 635fc861d55949e9c4b060efeaabd578
SHA1 247b04fe8228a2f4615262dd3f2195e8b2abb9e0
SHA512 a83be2154d3ffff02afb9cbee1925bce89069d48baf1485a12eef198e539c5011cca765d19970221a5b0eda47ce9022858cc71afe1acdfdda2167793df2dfc08
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 a1f9e748f08d00baf929d986e5c054c23f7430cb0faa0baea91418c86ae4eac5
MD5 f9ec2ce931877c9a8bb7472a3fd945dc
SHA1 db325f6900ae85500af4c99405395cecc2dde9de
SHA512 847d5b73d321ff256ce15490ece6cd122d36cb6f4e7e68cf2849b03b2f44260fc90516cec535ab80e084c1136ad12ac5fe4d210fd1a73289fbda62d2eb0c466c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cb99f6550f3a57c885092386cadec4b7b01a1717eab5396b8e2fa5c8527e6cd1
MD5 cb46701e1bc222b3b835908085af925c
SHA1 d21dacdb8045fd2cfe9d1d944a09783057849864
SHA512 44575a57ed6c8a68178ba85b3f679b2f5c6dc2fa3a01683157c404bd9d2c33b2921277f5dfc36f5f4b996369ae47308aa75a74e38ab7209a17ddc269d60b6e0c
SSDEEP 96:nok/oXgE1OwWwpvWMoiVmdeHk89mUWQyV+VD7ziEwb:nok/6xWGWMXjmrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1fa652c7d435cfc50e2ea995730c39e95aa973d0a939568cae811cba26216c4a
MD5 e76bcf0a5a4ff98c00806b4e1de3e9a0
SHA1 32a577967051062a980d0b9f45b6d120e1d6b987
SHA512 57c0fe697e13de2ae086dd5600df6637be80fabfbfa734aacc84e824a21c9b48a296ce60f4b5b2a4f510da33692f2c61e271953c48e690a59cc16132525121f4
SSDEEP 96:nok/+XgE1OwuwpvWMoiVmdeCuD1jkO9mUWQyV+VD7AiEwb:nok/YxuGWMyuDhDmrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 48d49c856103bfcd1c67b9050dd92120c78e7921ba2894dd9e7e154f0903057f
MD5 29d496e52383448a6c130a5e0c94dbe7
SHA1 252a0067a3307fa756451c1067abbd40c77c8fdf
SHA512 64de8673e3bfd0ad2f80f418b42f4ce039ed1ef04328eebcd43d588981548f58173f40e8a307050cebae006c87e7df4b1c34880d58f261ba5ed8098fb7b480d2
SSDEEP 96:nok/+XgE1jzwpvWMoiWR5mdeCuD1Jy2kO9mUWQyV+VD7AiEwb:nok/YxzGWMWYuDfy2Dmrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 29a6eb9c8c95dcb93a679bb8c8cae38573b561ecb3058e07fc9137797688eeea
MD5 ccbb43e6edbef310853883b21925c4a7
SHA1 dba13aea6ed1e75b90b967b88caf0923b3498ad0
SHA512 258daf5824894d771a7c36a082131a390d9af612e54b1a6e1897264a04cb5c9e77154da85eb1a801d5e8a8fbb75663247a7311bb74209711cfa0ed3dae463949
SSDEEP 96:nok/vXgE1jzwpvWMoiWR5mdeCuD1ekc8XPy2km9mUWQyV+VD7AiEwb:nok/PxzGWMWYuDZc8fy2fmrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 027939362e7b22438509eedf0d8a171802a047bf9150f21672a70be46c70cefd
MD5 fe5b775d033a980dd9b91baca48fc1cf
SHA1 6ba883cba19b4bcad590f717151de2a1c465e630
SHA512 6f40cb9f63f5b7c5510f56aa81e81bc0b88b2bc51c641102f90281d71f3bde45c3839dc4373e4a3b69e9b8cdf7048431796b8c62436a499f4e7cf657598fec38
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupGme2RUmxnyru8z8ZJ2WZ:A9iIxuERzA83h09RZxYGotyPz8+WZ
MD5 SHA1 SHA512 SSDEEP

Submit Download