759a7455de2c7b50a7d6c7839a0b4beee5ee0e9a93f35d819f0315aaf2b4513a

Analysis

max time kernel
158s
max time network
173s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/12/2023, 18:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
最新外挂.exe
Size 1.3MB
Sample231229-xbgr3sfhd2
SHA256 2056359fac01bbbdaf1359ef337cbf9736bbea6926e708b8754ea343e506686b
MD5 66953bb3c63563f61a0e069bb03e0b44
SHA1 e8688587a1273b37f01398c0121340a48bdf1705
SHA512 4c6a8fb0dc04d5bbb532bc971c1f0cf1efb1bbb34f688320cfe978f5262fb12847150d1c8c833b1205b24aa6a9a102f24dc37777dd752d8218865fe7ead46fb1
SSDEEP 24576:rBBBO8z6+uCo+SnnX7LSWzak5JZwfZYkv:rBBo+uJZnX3SWz/GhYy
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4180	KINSTALLERS_66_4175.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1976	msedge.exe
1976	msedge.exe
1396	msedge.exe
1396	msedge.exe
64	identity_helper.exe
64	identity_helper.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe
2596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe
1396	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3988	最新外挂.exe
3988	最新外挂.exe
3988	最新外挂.exe
3988	最新外挂.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3988 wrote to memory of 1396	3988	最新外挂.exe	91
PID 3988 wrote to memory of 1396	3988	最新外挂.exe	91
PID 1396 wrote to memory of 1920	1396	msedge.exe	92
PID 1396 wrote to memory of 1920	1396	msedge.exe	92
PID 3988 wrote to memory of 4180	3988	最新外挂.exe	93
PID 3988 wrote to memory of 4180	3988	最新外挂.exe	93
PID 3988 wrote to memory of 4180	3988	最新外挂.exe	93
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 916	1396	msedge.exe	94
PID 1396 wrote to memory of 1976	1396	msedge.exe	95
PID 1396 wrote to memory of 1976	1396	msedge.exe	95
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96
PID 1396 wrote to memory of 2872	1396	msedge.exe	96

C:\Users\Admin\AppData\Local\Temp\最新外挂.exe
"C:\Users\Admin\AppData\Local\Temp\最新外挂.exe"
1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.521171.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:1396
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff997bb46f8,0x7ff997bb4708,0x7ff997bb4718
    3⤵
    PID:1920
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
    3⤵
    PID:916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1976
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
    3⤵
    PID:2872
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
    3⤵
    PID:3716
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
    3⤵
    PID:1636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
    3⤵
    PID:5108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
    3⤵
    PID:2600
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
    3⤵
    PID:4428
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4100 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3928 /prefetch:1
    3⤵
    PID:4456
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
    3⤵
    PID:3936
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1988 /prefetch:1
    3⤵
    PID:4776
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
    3⤵
    PID:1504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,18259127549345409439,12869371424054596086,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5988 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2596
- C:\KINSTALLERS_66_4175.exe
  C:\KINSTALLERS_66_4175.exe
  2⤵
  - Executes dropped EXE
  PID:4180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

KINSTALLERS_66_4175.exe

Path C:\KINSTALLERS_66_4175.exe
Size 58KB
SHA256 84cc37ec6849e5634ed80fd1feebc54d7cbf183923a86369dde62a66afa7f259
MD5 1915689cf3a859e46042a10afdf1a0dd
SHA1 873ccfc9bf4130a87fb0804cd27dc7eb11fbe4e0
SHA512 fa375057475a05c170eee26516e38f3ef35d22fb649caff25ff4bf000bebb48d6286a6689509a11488d1355d9d7a3d910b40ff182455152bd23726a7dfc899fe
SSDEEP 768:bkpgjurpP2VYW+dk7plkfkW+14porhIIL4:b6TwVC+plkfDzor58
MD5 SHA1 SHA512 SSDEEP

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a
MD5 efc9c7501d0a6db520763baad1e05ce8
SHA1 60b5e190124b54ff7234bb2e36071d9c8db8545f
SHA512 bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 80333c661dcc930f4505a00ad4340c81e724f16a3f69cab09fd0216d8c651b6d
MD5 5ccf048870253b144141b509de04d9e4
SHA1 6ed22e41dbafe81f42312111265ab256bb1c11cf
SHA512 030c1c9b260c9ad8a988ea0c2a24143bddbd391c04c475e4f07b11decf1115ba2dc402ac7ea35171937422f1c757e2a5e00674ab97146e6ead2acaad4b694da3
SSDEEP 96:n/yk0PD1ZTlwpvWMoiVmdeHcfRDB+UWQyV+VDCzia:nKkKbTlGWMXOd+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 264ba6f39dceed924841b50db1e5e476058eb69b6046198d7242360a4bf31724
MD5 636839e57b9ad4a50bedf5de8e043838
SHA1 284cdccb7a38cfade0d1bc0584cab08e51597c41
SHA512 a89c288ef8de4d93ca8d0b45084217241ca1ca537aabd0ef60ab3353c542c5e306f699250a95ecc233e1e007c620fa6ba3c36a612cd10155383c7f12bd28e484
SSDEEP 96:n/UkfPD1ZTlwpvWMoiVmdeHcQIRDB+UWQyV+VD7AiEwb:n8kzbTlGWMXyd+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c
MD5 121510c1483c9de9fdb590c20526ec0a
SHA1 96443a812fe4d3c522cfdbc9c95155e11939f4e2
SHA512 b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81
SSDEEP 768:nrCWQ08F1+UoAYDCx9Tuqh0VfUC9xbog/OVSLllmrUBd:nrCWQ0u1jaXLVn
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 145805074d7e5b45535ff90486210ba94060eccb7e4821a6ba343029a4c24f27
MD5 1ed9f7e2b60b4fec241c8444f1b1fba2
SHA1 b505200c4a87e6545d1e5da8ec37c0e936a0f639
SHA512 16593e0f72eb31e65918c39576036ed3d973b712beb7f0740fa2c75a8e3c594031fbb2cf978f87dde687a15b953b8a0e9ef05757f1751467c5ca1d578f48ee29
SSDEEP 192:RoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwtzVe2RUF6bHEVs0aJGMmD:N9iIxuERzA83h09RZxYwnjqOEh
MD5 SHA1 SHA512 SSDEEP

Submit Download