36d81b1ffa79e44e02cfbfd4629d64595f8bf30bc11c359551b3ac14343381a3

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/08/2024, 23:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a5fb6d53bc282b0e2b32f7541d6644238730e145cbe32965a4c0dcfb300131b9.html
Size 105KB
Sample240830-3drb7asfpk
SHA256 a5fb6d53bc282b0e2b32f7541d6644238730e145cbe32965a4c0dcfb300131b9
MD5 3156feefa6c5ea620de48a6936ebb96c
SHA1 3cee02c194c3f28e6801f9d6261b4b5aea22da87
SHA512 1cce6dff3f858696e540c97711462091d1d53bdb9c5418012f7c6a384712341155b8600235fe77b11bfea4ccbd9eb4a2813a7d2ad5eeaa366ac1cf480334148f
SSDEEP 3072:gFGqbIrqbIVfTBuK/dVwtAch7EAhNg8cwbf:kzIIIZ8Ac5
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2640	msedge.exe
2640	msedge.exe
4508	msedge.exe
4508	msedge.exe
972	identity_helper.exe
972	identity_helper.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe
3932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe
4508	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4508 wrote to memory of 4524	4508	msedge.exe	84
PID 4508 wrote to memory of 4524	4508	msedge.exe	84
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 3940	4508	msedge.exe	85
PID 4508 wrote to memory of 2640	4508	msedge.exe	86
PID 4508 wrote to memory of 2640	4508	msedge.exe	86
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87
PID 4508 wrote to memory of 3948	4508	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a5fb6d53bc282b0e2b32f7541d6644238730e145cbe32965a4c0dcfb300131b9.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff807f246f8,0x7ff807f24708,0x7ff807f24718
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2040 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5624 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,6565779055854903485,15100989976047995249,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771
MD5 53bc70ecb115bdbabe67620c416fe9b3
SHA1 af66ec51a13a59639eaf54d62ff3b4f092bb2fc1
SHA512 cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89
MD5 e765f3d75e6b0e4a7119c8b14d47d8da
SHA1 cc9f7c7826c2e1a129e7d98884926076c3714fc0
SHA512 a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 cf314a8c91528f9a26744a4435dad5a06e4e24a972dc2374e643f51b3e0e670d
MD5 7810840b64cf5e99b166d193cecc119d
SHA1 9dd5d29dd493255ef0d283bf266ee6a59c6054b7
SHA512 e627ac46a5b223baeabac552abb0df882c4ff262772e6e4c80045cc297800a3c8ad332c9e11f73e36d2cb8ae8a427a29ff63f64bd31030de737d514e9fe3bbb7
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e4b8a5fb6aa30a1b59fb7a1e805f9d204bd93e2c5a105b4761a85e931e1049e5
MD5 868df7b4a9246c5c75651f6a0749eed2
SHA1 be789de500dbf69622c42c4aded6ead9d513113b
SHA512 d1a7b39149f20eddebaee43a1b66842167f689be79da96f174f29ac523e2d0af1c470a8cf137f1b292346527a46fc6d6d3cd43e16820a9ade81e441678911054
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 2754cef5fc1912b8dc6e61a2aff37610a5d04f9639a50fa2e745a403ca6baa3f
MD5 6b2ec4a0103ed1be21d256ecf8ec318a
SHA1 decce523c45a61fd4f83136d85d256e2fae4e506
SHA512 9d6b0019102e184f42b4e6d4f6c05a45b261f63222e369478eb1ecf33912a3565870b63cc93496554942e8e622c3d7aede7ad7df6b49e175c60a9d8ba920f023
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 652eb95c63e433b1598769c5372938ac84d8638409a3b25c5407ac4cdada13da
MD5 565ea44e5e08452c1b23d7922284d5c9
SHA1 156bc87b88e4e0314692ec6fc6e7f07b8112b5bf
SHA512 7c6be61b04c474767f65776e04fdbf24454c370a89e54f1b10236c2c2e33cf6ea1f77e2be71a56255c3d7b46c1286e038bff0bb7e6d7d8f2cfb63653ff1a77d7
SSDEEP 96:n3kxEwI1S5QwpvWMoiVmdegfGGXgXmI285qEqUWQyV+VDCAiEwb:n3kxAk5QGWMQfGGQWI2nrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a337c774459c2bb27b577197ad369bba615261ac6bcafe6b27dc5cc1a042d5f0
MD5 565c3c8b93e2ede1667b7f47f1ab66d6
SHA1 722351c6867baa5ef5f7b31b6ceb6f42ac2446df
SHA512 cc3f07ce4f8f98488df787eea27f59034b3fcc99d568979be72016b4adce9e7387890d24bcb27dbf050f0485ffdd957753d9b56db4d570207133095f353b0fb0
SSDEEP 96:n3kxkwI1SOQwpvWMoiVmdegfGGXgXmI285OIWEqUWQyV+VD7AiEwb:n3kxgkOQGWMQfGGQWI2Ugrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e876e9bc37f2fd416641e3e193a58cae085b86ff69f14bcc7b896c2dfa96d07a
MD5 83cb43dba9f61a59e3a7b14f07f23704
SHA1 8ae68191e7765e5c74f9e567637b6c4eef92ba87
SHA512 9521145cb9130a47cd798ee625ba9ed147323e91fdbffb07c2ba743b2b6179524e51a998b259534166064855c22130e9d2ca43162a4ba8ac5215ca1a0b7afebe
SSDEEP 96:n3kxawI1S5QwpvWMoiVmdeH85qEqUWQyV+VDCziEwb:n3kxik5QGWMXnro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 24d3d3ca6fb610662e487481e464e7be5ba994e053a0096cc90a1e7055520175
MD5 50f9f109715ec8762d8849cc31557a8c
SHA1 a2fcdaafa7a24474230ce1fc2662fb0e98642b51
SHA512 f7992f7f1a4b5d0241cea41ea9573bf404456dacaaa3a50e1786ffa1515a9145f4dd740ca4abbe28b33620ef0f466c7ef138ce41829bfeb0f42538776233c393
SSDEEP 96:n3kxEwI1SOQwpvWMoiVmdegfGGXgXmI285qEqUWQyV+VDCAiEwb:n3kxAkOQGWMQfGGQWI2nrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 537B
SHA256 a71f73f89b1e5644b4b9ca4b0e4e1ced5fb2d0b1247ec0f66a8628b875f505ea
MD5 8e3f56bc39eebb2490849f5e18a6b948
SHA1 96d43e31ca18891fab9ddd823598f55a6d8f3c76
SHA512 c93b98b3154bd6ce929db6380650f8205221e0960ae6724fe2b0f1940dc9c6fa6a6b1906bdd89852d4d8b11cec91fca435f75877c0965c8167ce33c548097298
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe587d59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe587d59.TMP
Size 537B
SHA256 c5573508fa3752f497e4e61daa8a944c32d621d157a4a61f02eea0d3b4b0e74d
MD5 819769e08c8dcc16126a3f12ffbe46b5
SHA1 eec1a396ad12bfb1534e7919a2850e4f5bca6237
SHA512 45bbad3e807ed9c89836d5796fd3362317ba09e49835da3339906fafaae240d8e73640499eac162d4bd8655594c61aec5e9616da9e2be5353f06b14af6694b17
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5752709aa536f5913a362fda79b147904d4405840006583fcb06095901833a8d
MD5 fd1e2fa499ed1ef17f3bb7a95e36b09c
SHA1 f178d716e031992a67fcbab5860eca5654e5a2bc
SHA512 3ebf2c2d7622afd54a1d6ef5a0041c30b7021a8fe88719b3132d887e6fa1e44f4ce4523a546dea66ceb9efe8728a54a2d801368e594b79e6ef5f2f49e1930b10
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupaRclA5e2RUW7i+BRw5Ytj/:A9iIxuERzA83h09RZxY2oAtHV6kLsIK4
MD5 SHA1 SHA512 SSDEEP

Submit Download