hxxps://github[.]com/un1cum/Beast_Bomber

Analysis

max time kernel
146s
max time network
147s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
02/11/2024, 15:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/un1cum/Beast_Bomber
Sample241102-s792aa1nfq

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\8779b60e-68df-4e84-af73-8239d3ebdacf.tmp	setup.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241102154806.pma	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3884	msedge.exe
3884	msedge.exe
3864	msedge.exe
3864	msedge.exe
3412	identity_helper.exe
3412	identity_helper.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe
5160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe
3864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3864 wrote to memory of 2752	3864	msedge.exe	82
PID 3864 wrote to memory of 2752	3864	msedge.exe	82
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 4360	3864	msedge.exe	83
PID 3864 wrote to memory of 3884	3864	msedge.exe	84
PID 3864 wrote to memory of 3884	3864	msedge.exe	84
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85
PID 3864 wrote to memory of 2508	3864	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://github.com/un1cum/Beast_Bomber
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ff9e5ad46f8,0x7ff9e5ad4708,0x7ff9e5ad4718
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:3840
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff6c55b5460,0x7ff6c55b5470,0x7ff6c55b5480
    3⤵
    PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4576 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,4851803057520121109,13437221068857952881,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5d1f5e30dc4c664d08505498eda2cf0cf5eb93a234f0d9b24170b77ccad57000
MD5 ef84d117d16b3d679146d02ac6e0136b
SHA1 3f6cc16ca6706b43779e84d24da752207030ccb4
SHA512 9f1a197dccbc2dcf64d28bebe07247df1a7a90e273474f80b4abd448c6427415bace98e829d40bccf2311de2723c3d1ad690a1cfdcf2e891b527344a9a2599d8
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 60bae7be70eb567baf3aaa0f196b5c577e353a6cabef9c0a87711424a6089671
MD5 39191fa5187428284a12dd49cca7e9b9
SHA1 36942ceec06927950e7d19d65dcc6fe31f0834f5
SHA512 a0d4e5580990ab6efe5f80410ad378c40b53191a2f36a5217f236b8aac49a4d2abf87f751159e3f789eaa00ad7e33bcc2efebc658cd1a4bcccfd187a7205bdbc
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 48B
SHA256 ab95de61ac22ee0e3d3ff15e900122008e64b8e87c6d134fdf44c14ec66b182c
MD5 4687c28279b4f25c44797fc3343614b8
SHA1 2e14fb7a168e3ef98d16fc68902254154983f408
SHA512 953354788253ffce8b9fb94130c0db901df56c867434cab0587163621ff847115c8d679bbf463d5be0c60473824cab47c6601e22abe3190c1c535a88cc02acfe
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 7bd05003b27073763deec0768123fb014b2b5f10f8dc90c963f2905f8f66f872
MD5 0c0dd3ac6ffb9535b0a41ff5f37d7749
SHA1 c0c0eec4ebb8f1aa62eea87452704e50ad52054d
SHA512 11fa21bfa7825915850501b6eb1d8d15c10f674575ce06e46b06eb00bc1405453e892dc131d17ec6a674b4c89d6518472be0340dc053bc8d4111ba00d8cab60a
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 686B
SHA256 d04a88b72bc92815ef0c082c731b7333a270dfd23eaf75c015e46a02f8844b0e
MD5 a402c6b54fce0a7bb190ea3ec2cac564
SHA1 f664f062a17279264872d367128756f19c7a534a
SHA512 5bf5d85ef3c2ac28d2bd3e344872ae6648e60117a69f363ec98f0d6ffa6afe4cb83c8f67b803835985d9f180d032bfd9bf18fe0fc80911368c70335824d6b399
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe58d869.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58d869.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0c4e478af3f31e2774da8e420d63e7deff970a6c89fedc3a9bfd8780f38d1d2e
MD5 f206b225e9cb91197dbd4f31f03e2368
SHA1 51cdc2df9b08f456443a64e15653e4330d33ce75
SHA512 ecf7fb9cf44da66eeba9f18632e7bee350b33118709d1d98729bc15fcb8dcb46459e319210163020d9d9c59bac96b34bc542ff4084fcdd4562e7750d2569301c
SSDEEP 96:nQaf1EmiwpvWMoiVmdeHmA5cUWQyV+VDCAia:nQ4a1GWMX+re
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 aeaf7b7957bc6696ec8d3321e641bf5a4f51602221cf6115de1d0d610d55a352
MD5 33da0090bf558b1a15c4a9449ba3739f
SHA1 65fc812e89e20645c645634060a3aeefeb327b10
SHA512 f896b65297531a8ba628497d767f1de438dde973fd275965defa82d8677654820ddef0b42bbdb1fc02c22a55df3a94bb27c0b685eba6533f898de8e6c613f719
SSDEEP 96:n6bf1E2iwpvWMoiVmdeeuKS1jmA5zUWQyV+VD7AiEwb:n67aFGWMuuthprg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 dcc3575f60b20c32eec5862d4b56f29f8a13d4d7085f819c191520d8d1cb6f17
MD5 5e5e29937e7bbec0b27f0c06d6a5be05
SHA1 97e0395929d976e5e91d51d2cb0bf287edb5a603
SHA512 428d2596835c2ac121de71dd09fffe762e86378b470ab468c39d5a4b7b5f3b11f269fbd21fd195e4ecd4e86af113455b8dedce276a23d28040fa04e7b9894a7c
SSDEEP 96:n6Sf1E2iwpvWMoiVmdeeuKS1jmA5LWUWQyV+VD7AiEwb:n6AaFGWMuuthUrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 bdec91a5061c6a400ef33c2dca5b1d0c16c1fe9e464f8ec99a72442b752e6a97
MD5 60d82bd601d64fd00bb0373f5ecd65b8
SHA1 0e8bde426270dfa3ea285c2c5b7282ab37771d4c
SHA512 5ea1b33784438acd246c02c95716f72c78293bc8d8e8e6d71aeaab370ae9fc2063ba8ffa443bbfc26c96e45a95549b62894b846a459c986531b34a110d0be38d
SSDEEP 768:nYW5N8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3LlJQrUESy:nYW5Nu1jauLj+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 8aa7eaf918f2969424996a8f3575478006d9d74b308a750f996fe4f5f045554e
MD5 0e98d1679e15688ad133f11eee8458ee
SHA1 a4b1a83f0a3f2867954d3146d95d314441950606
SHA512 eb34d52a8df4992444000a93c8d0d11254069b5f43a68a6def21061be03a538f36c42b2e968a8637f12b93235de3140002b0212aa2cdebe0950fd115c04bc72f
SSDEEP 768:nPYW5N8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3LlJQrUhSU:nPYW5Nu1jauLjn
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 03162156840aa94a3224285d83f1af91930f79d44444fe0f1b49169427bbe21c
MD5 6148f19779b43ef7ee67f70dae864ce4
SHA1 59d9b0a930e6df6337036da998ec37cd1a36ca4f
SHA512 97ffd6617fde0c90b17afb8daa0e7407fda15ba41f4c1ed04230a472075c01100cf1fcda43ce4d0371a9690db9afb3e01833f47c28849e2d28e57aab6f9f59f2
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSawBvYe2RUgq4GLoYu:N9iIxuERzA83h09RZxYSawBO8Ltu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 2cb5287ef9beef6d684ce5569e8cdcd6d17c8f9415aca383a3187495bda6a100
MD5 3169d3a3812119b2e99d5cd21794c284
SHA1 1d1cb1ecd19f580485ede19b4711f39e0db8fd87
SHA512 c5d0f2f9c167b3943213e872851e208698d22ba19b66ca02b416d8c18a9e962ccb444812e3dad57f8b81424e2c2ed5fa56dd39280608f165c98641b82b7ac035
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 f7b9084881c61e645668f18d6d0ac5ebdd2122e3c12a41c9e9be29d68fb74017
MD5 6440d2cb08a147d64badaad915b07f3d
SHA1 7f16e8978ab6cc44240619016361b7251701217a
SHA512 dc7c5fbedb6bde8f128c7d8c7cb0f3944a6bcd2b6c641d8d91020e561d058c9a131a1e6fcafe3a58634068b20e5a99326abbe3e73ff70f658184132d3d1b632c
MD5 SHA1 SHA512

Submit Download