hxxp://google[.]com

Analysis

max time kernel
299s
max time network
302s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
25/09/2024, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample240925-2vcdxssdkp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
4868	msedge.exe
4868	msedge.exe
3244	msedge.exe
3244	msedge.exe
2236	msedge.exe
2236	msedge.exe
2068	identity_helper.exe
2068	identity_helper.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
680	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3244 wrote to memory of 1340	3244	msedge.exe	78
PID 3244 wrote to memory of 1340	3244	msedge.exe	78
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 2044	3244	msedge.exe	79
PID 3244 wrote to memory of 4868	3244	msedge.exe	80
PID 3244 wrote to memory of 4868	3244	msedge.exe	80
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81
PID 3244 wrote to memory of 1220	3244	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://google.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff861733cb8,0x7ff861733cc8,0x7ff861733cd8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1876 /prefetch:2
  2⤵
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3360 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1896,7366148714332898606,10637079729507744272,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4944 /prefetch:2
  2⤵
  PID:3888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4996

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da
MD5 a8276eab0f8f0c0bb325b5b8c329f64f
SHA1 8ce681e4056936ca8ccd6f487e7cd7cccbae538b
SHA512 42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e
MD5 058032c530b52781582253cb245aa731
SHA1 7ca26280e1bfefe40e53e64345a0d795b5303fab
SHA512 77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 384B
SHA256 80f65d85f6da0ec3cfea5fee5ca8e5dec08589e870750d2eacd2ad9cf6b50f0a
MD5 696d97c48fd142099f8cdd560e5a1c6e
SHA1 fe61fddac129496bb8a19dfbae33bfdc126fa466
SHA512 29a88e4c3a799629cbbc056d74e44d23af0dc943b68b507a5ebd51add092a20b67291cdea0b70e62be2177e4cbc6733557e3c3f100ef2c5916ab78fe4bb93385
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 d2ffaaa766d692c6787d2ab3a3e3e0f59a011ecb9c518b3aeb3f15b708dbd5a5
MD5 eb08ae5b93b8a909d0adc80b72fba64c
SHA1 2be18f188cc148173d6510c7a56ed94a40edbae5
SHA512 63f781d8d1e854e4077d9ced2bdc05f5ecd0f58202484e8d347e16308197c763f5f262942333d94eb736bea2251e6b6ad5d57fe1b623a5b4f99583efdb08df3d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 45967f5c5f5102b413b3a327024f557530578ac615c6d722b8c9c39cfcad5ccf
MD5 77592754ecb436094f29bf0c5e5b56c4
SHA1 71620f65dd7313a295ef1d4882f1e40aa41b158b
SHA512 9aa0f5efa5343dc9ad2f0eb8a6e37817c4b76767c4661cbba145736d4dc517562b09ca8351ace32a8ec6808d9d3a888eb23d28a3a624274fc7de918e9cba3cdc
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 b9bb01c0c3218ff3a0cf63c670a659fb5d76539946bff33cd840316e5076df08
MD5 5192966bd2e386754506f017a06c0172
SHA1 4c53c996157e91347d13d255772f8ea0566b37a4
SHA512 c5af9d1cfe5fbd59934a6e372f21549512914078266e717576844266bf4866f1e7e60522970a61602895460bc0ca07a3d05fcf52a752972571c8909f517e0511
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0d0fb0b5be91183d4f68e67d7aaa880b31b3c4d0eace3c62aa6b4e75f5a7e8e8
MD5 1ae7d127e771e5b670304c4b8caddbb8
SHA1 f22b79741d56f5e85a217d21ae7079b4d14faf90
SHA512 6ce472e54a3a8eaff8215086aeff55f0081f200222e293eff92539ab78224ce03403dc22ee17a59ff0febab34758a6c6d1badd98936fc4390320ab8a14d842d5
SSDEEP 96:n6k3PKXekjzwSv0MoiVmdHIAJD0WQyV+VuziX3wI3:n6k3P2ekjzv0MAI2DLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5acb49992d0aa063b6902f6b9b08b83abb4f4fa4f9b8e7be91af7ff4200ac0e6
MD5 23af16a7dfbe3919cf5cab08a2ef1b87
SHA1 748fc1858856ff881413af6f8147fce842580b6c
SHA512 6aba70fa86789613bd04f17ef99cd98b0ae4cfa2e5d7e5775060e9a13acdf0c6d35784091ed4158f6bcfdf0985fa75e185cc02d3451c6aedf633b8d0f3c52093
SSDEEP 96:n6k3PMLXekzzwSCU0MoiVmdyu+1jI2JD0WQyV+VpAiX3wI3:n6k3PmekzzCU0M3u+hIEDLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 51461d7925874e577699a7f94c1417a4adf3b26d588c8f26da0b828357891e90
MD5 eb4ff18362c1f08f8ef1751d41785e6b
SHA1 15bc53a0600548204a1136b5dc5a3448ba92a9a9
SHA512 8f5593ca6f3b70fe34eaf8b6292942bd5d580302f7c2e28297b0c1158217863a752134ee2b32efe3eddb444a952d7c217adb8aa5fca15b7c148f99fbfc24115c
SSDEEP 96:n6k3rMSXekzzwSmmU0MoiFR5mdTw/jNIPJD0WQyV+VpAiX3wI3:n6k3rrekzzmmU0MFgw/pIBDLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 703B
SHA256 9e113369ea1ef311137832704f77330a7db73d1b953ad5b437ff50656f558ad9
MD5 fccdf954b509751f23ad8f639df95e63
SHA1 35f63e0d772d65f0ba1f7f44b2da68365a274c12
SHA512 08a8f77f0b5cb48779e6ccb14d9ea501a21bbef65a8eb80c3c5a597859cc7251b470d45150158d7861555a72c17a8b97d1d7f4dd3194027c507aa86eaf225245
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ff40.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ff40.TMP
Size 368B
SHA256 54ee515fd051b1faf48e45c2a8be8288ef8df11f56b04639dcc0e24cbf8c357d
MD5 06761828dff3189e00f0638a77fbd49f
SHA1 f1581e916afed44997a7a27bb764230ae9294cc2
SHA512 d912f6b63c454c53985c1f14e58980c1cd3ffb72f2abf0b11ce66c44978d96fc5c5fbfea7e4cf90a3fa961684d7bf69cb1eb5a2dfdf74081bedf72e118c89c94
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 5975b4181b91b8468a05a0dc45fa491e9f6bc58cabd11908c9d7263256d36f75
MD5 c722afafb7dbb89dc049374a9eaf85e0
SHA1 b9e0a2a3953d60b9f5aa9428b94a20feb0444a0b
SHA512 9ea78a04f7f5486a5a3842b316c3271621fce07eb1f164deb4027d882e939679112e6a0f511130ed921512ffe4d664ad91310ffb3b0cd4c3100f520de8d9f6ef
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGZNIWlIe2RUjaR2QhN9J4oQ88:M9iIxuERzA83h09RZxASGLOGkhN9J4oU
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 cb810e32778dd9eb76b7936f4035d40597039290c2105fb8cfc404aa100d134d
MD5 8aca546445f7ae3be981a903bfdfe9db
SHA1 04ebb6cf737bd965bcf4bdd31285cf562f02f9ff
SHA512 46d3acb79faa4c2cf5d852ccb0a0c283f6126848c6aa5689599e9d1643aecc1aae42ecb5a0d4745ffc964a17a49e297977f6939daa079716594734342b5ab7ab
SSDEEP 192:DoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGZNIWlee2RUj8SOYbYN8Vj9Jh:j9iIxuERzA83h09RZxASGLoG8ebYN8dR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fa2a6e94a2c219a8877ab98e040333f21c5e3c385387deba77fbec738bbb1c3e
MD5 66a6e389423ce1ba35d0d7d0f207583d
SHA1 556f3ce6aa7f13c9b04ad8c8086a6a22d64df487
SHA512 457dbe4bd3a7659d6522eea11d75c152dc5109aaccfbb99fdf6a08f495b541cd38758aed671fc90a24681c654e79ce9da14f1f4da631bb669c0f98b08b492067
SSDEEP 192:1oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGZNIWlee2RUj8SO2QhN9JioQ9:59iIxuERzA83h09RZxASGLoG8phN9JiZ
MD5 SHA1 SHA512 SSDEEP

Submit Download