hxxps://cdn[.]discordapp[.]com/attachments/1258441278639833159/1304939908191752252/Main[.]exe?ex=6731377e&is=672fe5fe&hm=ec390d4c6878e35e35ce6e0a1cd72335b84af5adae0cae47ec7d678626066189&

Analysis

max time kernel
1681s
max time network
1686s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
09/11/2024, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1258441278639833159/1304939908191752252/Main.exe?ex=6731377e&is=672fe5fe&hm=ec390d4c6878e35e35ce6e0a1cd72335b84af5adae0cae47ec7d678626066189&
Sample241109-2qq2hssres

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\20241109225749.pma	setup.exe
File created	C:\Program Files (x86)\Microsoft\Edge\Application\SetupMetrics\be11d5c0-6f10-4042-ae31-7abb8e8c5c3d.tmp	setup.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\Unconfirmed 439392.crdownload:SmartScreen	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2264	msedge.exe
2264	msedge.exe
4288	msedge.exe
4288	msedge.exe
1848	identity_helper.exe
1848	identity_helper.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe
5948	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe
4288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4288 wrote to memory of 3252	4288	msedge.exe	81
PID 4288 wrote to memory of 3252	4288	msedge.exe	81
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 5008	4288	msedge.exe	82
PID 4288 wrote to memory of 2264	4288	msedge.exe	83
PID 4288 wrote to memory of 2264	4288	msedge.exe	83
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84
PID 4288 wrote to memory of 1992	4288	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://cdn.discordapp.com/attachments/1258441278639833159/1304939908191752252/Main.exe?ex=6731377e&is=672fe5fe&hm=ec390d4c6878e35e35ce6e0a1cd72335b84af5adae0cae47ec7d678626066189&
1⤵
- Enumerates system info in registry
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x124,0x128,0x12c,0x100,0x130,0x7ffe288f46f8,0x7ffe288f4708,0x7ffe288f4718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --msedge --force-configure-user-settings
  2⤵
  - Drops file in Program Files directory
  PID:900
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --type=crashpad-handler /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler --database=C:\Windows\TEMP\MsEdgeCrashpad --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Installer\setup.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x248,0x24c,0x250,0x224,0x254,0x7ff791c75460,0x7ff791c75470,0x7ff791c75480
    3⤵
    PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,5646511080085237769,7194005544345952979,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3b19522cb9ce73332fa1c357c6138b97b928545d38d162733eba68c8c5e604bd
MD5 467bc167b06cdf2998f79460b98fa8f6
SHA1 a66fc2b411b31cb853195013d4677f4a2e5b6d11
SHA512 0eb63e6cacbec78b434d976fa2fb6fb44b1f9bc31001857c9bcb68c041bb52df30fbc7e1353f81d336b8a716821876fcacf3b32a107b16cec217c3d5d9621286
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d0d1f405097849f8203095f0d591e113145b1ce99df0545770138d772df4997f
MD5 cc10dc6ba36bad31b4268762731a6c81
SHA1 9694d2aa8b119d674c27a1cfcaaf14ade8704e63
SHA512 0ed193fdcc3f625221293bfd6af3132a5ce7d87138cd7df5e4b89353c89e237c1ff81920a2b17b7e0047f2cc8b2a976f667c7f12b0dcc273ddc3b4c8323b1b56
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 e23040951e464b53b84b11c3466bbd4707a009018819f9ad2a79d1b0b309bc25
MD5 e5e3377341056643b0494b6842c0b544
SHA1 d53fd8e256ec9d5cef8ef5387872e544a2df9108
SHA512 83f09e48d009a5cf83fa9aa8f28187f7f4202c84e2d0d6e5806c468f4a24b2478b73077381d2a21c89aa64884df3c56e8dc94eb4ad2d6a8085ac2feb1e26c2ef
SSDEEP 1536:vAlMWz7vLDtDSVlXXwpFlorgLUxF+D4n6owPFCawP/:vvuWAUxFaoGw/
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 186B
SHA256 ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3
MD5 094ab275342c45551894b7940ae9ad0d
SHA1 2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e
SHA512 19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State~RFe58b58f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State~RFe58b58f.TMP
Size 59B
SHA256 226eec4486509917aa336afebd6ff65777b75b65f1fb06891d2a857a9421a974
MD5 2800881c775077e1c4b6e06bf4676de4
SHA1 2873631068c8b3b9495638c865915be822442c8b
SHA512 e342407ab65cc68f1b3fd706cd0a37680a0864ffd30a6539730180ede2cdcd732cc97ae0b9ef7db12da5c0f83e429df0840dbf7596aca859a0301665e517377b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6e44e14a6aed4269f697f83316e014e4412f5e6681229d70b5e3551ad2b36fa2
MD5 13bcb81e660bde3ac25f61d6d2273329
SHA1 c6073e008738861bbcb0b65ad7a8ff8261fb483e
SHA512 05e651500bcf5922d2201cf8eaa6e6c73bd673554d7596b4b36dcbd4b3dceaa3f688b2ab55b7a997ff3775b9e4cebf07dcd69fca62bd85415bda54f6b3386ffc
SSDEEP 96:ntDsQjV1funwpvWMoiVmdeHmM+i++UWQyV+VD7AiEwb:ntPlQGWMXmJt+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 debf671e403fc40f855948c0b65c6ac9cda8332213b89a344443d59674561310
MD5 55334caea744e65ae438a6c197039e58
SHA1 22be6571a87a0081053da2129b764548d7298850
SHA512 4836df1a91642a4ed5863b2d3789bce5b89fd195956a25400eee73aabfc90b30793f151bf94f8eb82352e7adc369d875eeab39458d13f9332106dd7906c0e7d3
SSDEEP 96:nLFV1funwpvWMoiVmdeHmM+i++UWQyV+VDCAia:nLLlQGWMXmJt+re
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5e6e35d7e304315cd91d2d2fd54237e2ecd0bb84fae09fda5b64ac56cc00fd75
MD5 045bd1006e278a866d2eb703b0ab0ff1
SHA1 58a898b36c789e276d52294d3d3c82d7bc44d03b
SHA512 72156f8e943673618489b77df20bb79f043f73b115a51da95c44194d700e2a490f4f9086f698dea17d75cf9c77a92b51c14ffa09536424cb54e23a34e43a1348
SSDEEP 96:ntDsQaV1funwpvWMoiVmdeHmM+n++UWQyV+VD7AiEwb:ntMlQGWMXmJ++rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 56f7a77549e5fc45bd4b1f7c2db3e8b4bd1dd9234545207613a80342cee8e7d8
MD5 5c2d5c900312f44e72209416d45723cb
SHA1 68fb8909308589149399c3fb74605600833fbbc1
SHA512 07c2920cff7c1125e3a2fe66bf21d8606a1f2a3d36be2d8e136da0d2a21130242ac8324f18cedfb0040304cf804815861767c969a6923d8db851312bf9b4348b
SSDEEP 768:nFGWa68F1+UoAYDCx9Tuqh0VfUC9xbog/OVQLl8MrUkX2sYs1:nFGWa6u1jaxLykX2sN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 087debdcfba4666c03a5ea699e9bb31cf22ef4e0fad7c961cb0b500e5d262fb5
MD5 3b964859deef3a6f470b8021df49b34d
SHA1 62023dacf1e4019c9f204297c6be7e760f71a65d
SHA512 c30b7e1b28820a5815b52634b46cb210c241704e33e41304400cb3ed29e82ec547a1068fc819350b368456bcabd27034afade5add3251dc74e4174f51b6c7adf
SSDEEP 768:dGWa68F1+UoAYDCx9Tuqh0VfUC9xbog/OVQLl8MrU5X2sYsx:dGWa6u1jaxLy5X2sp
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d2e2b60f657b0d1b4e83133954c8e8eba86fd0ff8e840d5fef8e590f800e2bf4
MD5 332308a62fc0dca49e9d376117a6123b
SHA1 19ed3fb9c39db1902071310858bb5898b3266537
SHA512 ef56fd32fe988a8be5a9c08a120f594eb356c70195a29d03dd4f12277fb605d8190821c756fedf36e0a8dd15f8eb8af60be8eb45b64f89e7bca08ac5e504bc5a
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupSWhe2RU04mNwwkiu:N9iIxuERzA83h09RZxYSW17lvu
MD5 SHA1 SHA512 SSDEEP

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 cba3f7f9274dce23c11cf160fa7b2d11fef80587994bb8b9c3d51c6fe707622e
MD5 bb889ccfb26a63c1c2dc811f5b7fbf33
SHA1 6ed47c61519701a8e35b4a74b87f3475e4bae3e2
SHA512 8e52c124dd09c0753cc06209f1b4bd977e00f3efbb9726a3cca859f0b796b74afaedc8a968f52e2fb62dd20b9f2237e9cea5219e54a401cd750a2bd8f91277de
MD5 SHA1 SHA512

Submit Download

ccba5a5986c77e43.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\ccba5a5986c77e43.customDestinations-ms
Size 3KB
SHA256 ad681e9d401c8643060365cc533677308e12005ecaa88d240a6d07758f92854a
MD5 9fbfa8c27ce47478cdb488706f0a8284
SHA1 9a4af0393a9c09233bfc42f69d5b78263b56edc3
SHA512 aa5fed955ee40d86be5ff5611b3e587d2b267676b7e6d9b258d8261256dae0ec53c17973836e668c2e4bba4a2299cd16a5c59a7e6c22472c6afd77cb5ac9c249
MD5 SHA1 SHA512

Submit Download

Unconfirmed 439392.crdownload

Path C:\Users\Admin\Downloads\Unconfirmed 439392.crdownload
Size 8.4MB
SHA256 20a04be22347e482cd36555c9d39d6a5fc49688e9b7fe05c3d5053d57a9a8a3c
MD5 3676b3efacb44048818e02e47dbe4d1e
SHA1 5a14be3f382571a9645a40f73c7da962dc461db7
SHA512 5dd8452ec54d41c67602387bf3560674b48944ee7a768374ca438322326ded672fd50887f3fec80a1438dfd77afe931d5d174e933f84146d3c82d3e83698d86e
SSDEEP 196608:SZk+eeMf1T7DpOWGOVj3VNkd8cqqEX/8kOm4N4f4YhHQUQg:IkkM9kE1lNkdWzpbc4f4YiUQg
MD5 SHA1 SHA512 SSDEEP

Submit Download