676498f292b3a47c39fadd65d8400735c92d0453aa627b1013cb4fe5a100be2d

Analysis

max time kernel
57s
max time network
55s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 15:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe
Size 168KB
Sample240914-td83kasfnc
SHA256 771fb65b9e55db17bca18ea3594e8e8b4d5ef060919844c0641a02d9c3326b1e
MD5 8df48db76679f51e832e0b48a89c509d
SHA1 d1f0f17e91e91cc4e1647c2aa8a7f39af2793125
SHA512 0e387586091b5455feb19fdfd45cea73f425cf1b8cc8fdc11e68d78826e30f3d148731713c796c0106aee1e756c514fa8ecade656261edc517333245170596c8
SSDEEP 3072:ELUbqjhjDUyx4HCIRoL57WpTlbYsb+L5QgDgZFHdrLTc5wEKctIZ:h4jJ4ORWpTlbYsb+L5QgDgZFHdrLTcml
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1092	msedge.exe
1092	msedge.exe
1500	msedge.exe
1500	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe
1500	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1500	3632	d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe	92
PID 3632 wrote to memory of 1500	3632	d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe	92
PID 1500 wrote to memory of 4436	1500	msedge.exe	93
PID 1500 wrote to memory of 4436	1500	msedge.exe	93
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 2296	1500	msedge.exe	94
PID 1500 wrote to memory of 1092	1500	msedge.exe	95
PID 1500 wrote to memory of 1092	1500	msedge.exe	95
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96
PID 1500 wrote to memory of 680	1500	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe
"C:\Users\Admin\AppData\Local\Temp\d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1500
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ffacee246f8,0x7ffacee24708,0x7ffacee24718
    3⤵
    PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1092
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2628 /prefetch:8
    3⤵
    PID:680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
    3⤵
    PID:1172
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
    3⤵
    PID:3204
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    PID:1832
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5124 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1684
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
    3⤵
    PID:3020
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
    3⤵
    PID:3220
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
    3⤵
    PID:1124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
    3⤵
    PID:2128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,15995903590025813781,4513331750128556695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
    3⤵
    PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=d1f0f17e91e91cc4e1647c2aa8a7f39af2793125.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:4956
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffacee246f8,0x7ffacee24708,0x7ffacee24718
    3⤵
    PID:4752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2852

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 41d61eb39642d170ac390a6dbb5879ef09bc3ccd81d21bbd4dff1fd20131d23e
MD5 e289cc3df5d661c398de0e6c4a61d9b7
SHA1 798156acab2d55e8f36b6e505bc3e73281eaed7e
SHA512 d25e5fab7e751bf09d201a0b4f77dbdfea1270efe63d941c009fc342a90baed4ae582690a27c9645433382a721bdb04f2426aaca980e79feb2dabf0ea22dc796
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 eef8fe9b64f91f1e76a2c30d1ec42075c25c49379877b4492227af2f1203e610
MD5 212242c333543ba74542de3a189c510d
SHA1 5c4d2823f0ca6b42c769e7013ed8c58f0a529b32
SHA512 20c1ebaab92159716fa479bc876c321eb942942083f4c61f58da88b2353b72086d48d3615cc871d27a87a5a01dae1aff8fde0ff08ea0b1b63949e8ec62a6b8c4
SSDEEP 96:n7Gk/0LI1S8LSFhPwpvWMoiVmdeH/bge+UWQyV+VDCziEwb:n7Gk/WIEVFhPGWMX0e+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 730ca45e9a23afbe106d7b1cb68324c6511c3bc362a61f3fc019c50b1a11c932
MD5 35669936aa89cee8a995ab636e3cc2db
SHA1 897207cc67d1516373cb55d034a2ad9e5de857aa
SHA512 e5963555bcadd419b201e55804701a0c10520b83f56d71644c0868ef5cb50b2ecf6a26a3e138d87982a5ba001d84651f2f1b2e5fd55515f2c599748e04fa0a43
SSDEEP 96:n7Gk/aLI1ynLSFhPwpvWMoiVmde1mhYIMkdfNhpURlge7UWQyV+VD7AiEwb:n7Gk/cIA+FhPGWM+YIB7o6e7rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 38c2693f56149d6c2172dca999c73e2db60e7a103283ca662ac26c5b5a103c66
MD5 75e220321439a001db90787b45be422f
SHA1 1116f4e4e3ef23bd89d5c140c27675a863ed7759
SHA512 aa5a40bb79de167ac5198710d95cd78d81e9cce5a8fbb828e65e9339a0e65764519f40616a79ab5f5f8b028bf120320efa1c9765e26fa0146cae52f89ec30983
SSDEEP 96:n7Gk/aLI1SELSFhPwpvWMoiVmde1RWu/V1j/nzFge+UWQyV+VD7AiEwb:n7Gk/cIE9FhPGWM3Wu/VhfWe+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 a2fac487e584f6607418ede6fecc2ed7e1c67cab8294d7293e087cac754880eb
MD5 334b7658c6318d3c5d4bfff011236d85
SHA1 433ef17a2f5c396309d3eea4b263010b02816e50
SHA512 97e23b9c9be7e4d06761fbaa749c7cffa6ec26c75f53a0f35a2de56e1ae0016cdedaf1978c5f679058e4b5b3e37d37fc9f473040086be0d60e2e247b2dc29906
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe5810a5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5810a5.TMP
Size 371B
SHA256 e908fb925560b6f0a3c4e34c60c697d9bbdf32e88e1dfdd719c119d25cf35a16
MD5 775829c54925b52e2d154be2b4984ce0
SHA1 ccc048c556966588c688ee310c627ed8827aa901
SHA512 9fb68c0b3b6552f90fb48aa6f4e15a3e8b5d33218eee22f3ef58e38cb0646339ec0626b28f1a5f78e8f064a186cdfeea3e35c28711a6edbb808bfc078b48b433
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 2b57849eafda2f8a44dc2a5e745b7db983c16b6c860b6f5b64f752bb7b82d02b
MD5 b589c59ede3906b631e8bb7a28aa661b
SHA1 16e0637556d289854c844e9038d061d43923d92e
SHA512 500b0245e919724aa0837dd3c04a756b679e3b6914600f4450c3ac36339f1c230c98d012cdd85efa4e56b813d4708678b3c9a2b82328ad5d197f6d6949547fef
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupJDue2RU9PKxNc6TeuLJ5cv:A9iIxuERzA83h09RZxYJkNv7JCv
MD5 SHA1 SHA512 SSDEEP

Submit Download