691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee

Analysis

max time kernel
116s
max time network
114s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
18/11/2024, 18:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe
Size 202KB
Sample241118-xcxvpasmex
SHA256 691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee
MD5 e40eb9e0a8631f33c59c75d58a13d848
SHA1 341fa043a97386227b145ac81711bce2481c2d7a
SHA512 91a8c80a03446174dccc9309ba6865ae090e87c365af73fded4d3507bf81b00f81839e32db69eefef7a6a05d244b94209bf5db3a61353312eb8e1add6a6f6ca7
SSDEEP 3072:DzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIHF8JS04/B4tD77heYN1uadhNJ:DLV6Bta6dtJmakIM588PhhekEWNJ
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
4080	msedge.exe
4080	msedge.exe
1160	identity_helper.exe
1160	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 984 wrote to memory of 4080	984	691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe	96
PID 984 wrote to memory of 4080	984	691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe	96
PID 4080 wrote to memory of 3128	4080	msedge.exe	97
PID 4080 wrote to memory of 3128	4080	msedge.exe	97
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 2948	4080	msedge.exe	98
PID 4080 wrote to memory of 3868	4080	msedge.exe	99
PID 4080 wrote to memory of 3868	4080	msedge.exe	99
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100
PID 4080 wrote to memory of 2196	4080	msedge.exe	100

C:\Users\Admin\AppData\Local\Temp\691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe
"C:\Users\Admin\AppData\Local\Temp\691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4080
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xfc,0x108,0x7ffb25cc46f8,0x7ffb25cc4708,0x7ffb25cc4718
    3⤵
    PID:3128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
    3⤵
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3868
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:2196
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:5004
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
    3⤵
    PID:408
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
    3⤵
    PID:4472
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    PID:1928
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5480 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
    3⤵
    PID:1972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
    3⤵
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
    3⤵
    PID:4612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
    3⤵
    PID:3820
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
    3⤵
    PID:4948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,16707680234806197189,10367316975704288108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
    3⤵
    PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=691db20ab433e10f5e44ddef5d0bdca9673be91b402ac3abe40f1a7d14d048ee.exe&platform=0009&osver=6&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb25cc46f8,0x7ffb25cc4708,0x7ffb25cc4718
    3⤵
    PID:4044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3296

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8
MD5 99afa4934d1e3c56bbce114b356e8a99
SHA1 3f0e7a1a28d9d9c06b6663df5d83a65c84d52581
SHA512 76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9
MD5 443a627d539ca4eab732bad0cbe7332b
SHA1 86b18b906a1acd2a22f4b2c78ac3564c394a9569
SHA512 923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 e2967298017af538fb1b3f9db0275fdd3a2bd18ac5471b8a5748f9ccbb3b0e59
MD5 21483d8890edb81f97f707a7bb6d6923
SHA1 74455d18d8ddf8b9d9adf187a06b1d3a9193e1ff
SHA512 cc6fdffa73a79b3b6cc379eebd7db0c19a91494cbf10678ff30ef31412475a1afab4688e6a4d932d1ad02211fcaced8d2d9c2c47be078d00605ca7b9b43bda3d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 65c8bcf99c8c309ebe5911c8e8b5480efe753de88909cbb5c3a23155dd874516
MD5 08eeed58ef1f680bf41e7c07aa9f555e
SHA1 c6b0532638cf1ad0c0d1c75f15a677d09daa9639
SHA512 570a6188948fb70d4b3685f303c0ecd0db3a988cfe6fd26f90ffe16554af5e5b1c6bce5f356cd75696e9f1b019a9858f54f71dda6a12f57470dd309ee1d07d32
SSDEEP 96:nQkZ11WxWI/wpvWMoiVmdeHtuEsUWQyV+VDCziEwb:nQk3sxT/GWMXWro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 3d385947ce094e96637a2c339dfd6a627ed3e86107e4352e9b9052de1db22384
MD5 beb54f16cbdbdf67e8b3e49b814bca89
SHA1 34094bfbe8b6bf87e0f45d8780db63b2983aa645
SHA512 35ce9475b91187059f6c6d6898ad12dd954c984f448a7ce62e20225571764007a1b7d13a8c8876f145c1e5caaf3e49922882f21b2e74fda36180bf3a111b3c99
SSDEEP 96:nQkC11OUWI/wpvWMoiVmde1NYvMkdfypSuhCUWQyV+VD7AiEwb:nQku4UT/GWMfYvB6Org
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 5abbfd39ea46e60580e96ea4caf87c9d4c4f99b613a3de86660124eb981f198b
MD5 c9b9d536d836de6ef0c40e139311b5ab
SHA1 5bef3193ce222fee1bbc386e116fa050c8f9c6f3
SHA512 cc2274af1be9d162abcb024bd5cac1037d65caea5d061394702308450ca825a726041f5be922b20ed4176fe1ecfc85e396fe7dcebb28652fb52e46e82faf31e3
SSDEEP 96:nQkC11WhWI/wpvWMoiVmde1EuM1jtuQsUWQyV+VD7AiEwb:nQkushT/GWMGuMhwrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 371B
SHA256 0e92881958c2d2fab7c3d3ac9c0af030d2ced088260996b263aa6f3a2647eab5
MD5 2cc2a89d19aab726c6866ee9565ac4b9
SHA1 f31703af972814d91da4146e49970226e346343e
SHA512 0eb8f1f308f8db4ddb7e0d9681a8cdbbee770d125fa6c2d438f7a67e8ac5214ca5e057f9c3d4cd2d8dc64124c12d13c7cf5a324fdb3b111199602fe5a8ff5c93
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe586be4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586be4.TMP
Size 371B
SHA256 1db74860c874574d5ad64fab54b7d94eecfab3e1bd67b0abef22a85430e5083f
MD5 d33a281d254b1e3a4903c9b9232617e4
SHA1 a4c2d82a5219f88c64d6890b2ad7079f2a67fb0b
SHA512 1ed4e879ef99a7821f948cef230c44a723a9b98fafcbe0dc05d3b731b352d8cac2e070d97f3fb8c883129f2d8e63bf4e87760bc36ebb9766438bdef6fd06cc0f
MD5 SHA1 SHA512

Submit Download

ba3cc5fc-bdf2-4487-8110-7f13ae997bdb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ba3cc5fc-bdf2-4487-8110-7f13ae997bdb.tmp
Size 437B
SHA256 3aacb982b8861c38a392829ee3156d05dfdd46b0ecb46154f0ea9374557bc0fd
MD5 05592d6b429a6209d372dba7629ce97c
SHA1 b4d45e956e3ec9651d4e1e045b887c7ccbdde326
SHA512 caa85bdccabea9250e8a5291f987b8d54362a7b3eec861c56f79cebb06277aa35d411e657ec632079f46affd4d6730e82115e7b317fbda55dacc16378528abaa
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 8eac4d3e9a305d1983e2b894208450f3160b7815a222d5461e92bcc98c387ca3
MD5 08dc5b40b705ee070706205a530301ad
SHA1 03b6e6ab43dc5b2c001451d30b36df2a7d9b18ad
SHA512 c7c10a19a93d0f3a3e2b8df46d8b767802c492bd670a18958a13f999dfd3ac879c63b04d9b85b51930860cacd7973b1243e4aa4050a1ac2fb25e538673d1cce0
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupTe2RU2Jb9YdF980JQwUHZ8:A9iIxuERzA83h09RZxYDZ9Yi0YPu
MD5 SHA1 SHA512 SSDEEP

Submit Download