03ddad4329af7ddae408ac1578d26aab412460a6583465b05266aeb5c16880de

Analysis

max time kernel
159s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
31/12/2023, 02:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

24092d27bea63e7f69290456095d1873.exe
Size

121KB
MD5

24092d27bea63e7f69290456095d1873
SHA1

f810caabbfdcbeb09c47d70be1db8b28b16c378d
SHA256

03ddad4329af7ddae408ac1578d26aab412460a6583465b05266aeb5c16880de
SHA512

4678df78862a295f3a861ce55a28a3d5f5b815592fcdc43b94750d6530bda17730d8fb31c3d6c5d723b98dc4fcff19377cc8b6dbee27c1fdcbc96ceda195c8ad
SSDEEP

3072:SwxVMhOC/dTDbq91+mno3t4QZQ3rwmgZfYLJkt:STfFDbRnOTrwNZwLJS

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	24092d27bea63e7f69290456095d1873.exe

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\WINDOWS\SysWOW64\config\复件 (189) 3	24092d27bea63e7f69290456095d1873.exe
File created	C:\WINDOWS\SysWOW64\config\2.vbs	24092d27bea63e7f69290456095d1873.exe
File opened for modification	C:\WINDOWS\SysWOW64\config\2.vbs	24092d27bea63e7f69290456095d1873.exe
File created	C:\WINDOWS\SysWOW64\config\__tmp_rar_sfx_access_check_240622765	24092d27bea63e7f69290456095d1873.exe
File created	C:\WINDOWS\SysWOW64\config\复件 (189) 3	24092d27bea63e7f69290456095d1873.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000_Classes\Local Settings	24092d27bea63e7f69290456095d1873.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3396	msedge.exe
3396	msedge.exe
4332	msedge.exe
4332	msedge.exe
1688	identity_helper.exe
1688	identity_helper.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe
4332	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3548 wrote to memory of 412	3548	24092d27bea63e7f69290456095d1873.exe	91
PID 3548 wrote to memory of 412	3548	24092d27bea63e7f69290456095d1873.exe	91
PID 3548 wrote to memory of 412	3548	24092d27bea63e7f69290456095d1873.exe	91
PID 412 wrote to memory of 4332	412	WScript.exe	93
PID 412 wrote to memory of 4332	412	WScript.exe	93
PID 4332 wrote to memory of 4164	4332	msedge.exe	94
PID 4332 wrote to memory of 4164	4332	msedge.exe	94
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3428	4332	msedge.exe	96
PID 4332 wrote to memory of 3396	4332	msedge.exe	95
PID 4332 wrote to memory of 3396	4332	msedge.exe	95
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97
PID 4332 wrote to memory of 4656	4332	msedge.exe	97

C:\Users\Admin\AppData\Local\Temp\24092d27bea63e7f69290456095d1873.exe
"C:\Users\Admin\AppData\Local\Temp\24092d27bea63e7f69290456095d1873.exe"
1⤵
- Checks computer location settings
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3548
- C:\Windows\SysWOW64\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\WINDOWS\system32\config\2.vbs"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.gggirl.info/2.php
    3⤵
    - Enumerates system info in registry
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    - Suspicious use of WriteProcessMemory
    PID:4332
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x7c,0x108,0x7ffad7cc46f8,0x7ffad7cc4708,0x7ffad7cc4718
      4⤵
      PID:4164
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:3396
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
      4⤵
      PID:3428
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
      4⤵
      PID:4656
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
      4⤵
      PID:2644
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      PID:4668
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
      4⤵
      PID:3840
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
      4⤵
      PID:2280
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:1688
  - - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4604 /prefetch:8
      4⤵
      PID:4916
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
      4⤵
      PID:4196
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5368 /prefetch:1
      4⤵
      PID:2432
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5144 /prefetch:1
      4⤵
      PID:1788
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2280 /prefetch:1
      4⤵
      PID:4548
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1804 /prefetch:1
      4⤵
      PID:1892
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
      4⤵
      PID:5852
  - - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,3866368956147276292,5312711736659681818,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5652 /prefetch:2
      4⤵
      Suspicious behavior: EnumeratesProcesses
      PID:6076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2168

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
011193d03a2492ca44f9a78bdfb8caa5

SHA1
71c9ead344657b55b635898851385b5de45c7604

SHA256
d21f642fdbc0f194081ffdd6a3d51b2781daef229ae6ba54c336156825b247a0

SHA512
239c7d603721c694b7902996ba576c9d56acddca4e2e7bbe500039d26d0c6edafbbdc2d9f326f01d71e162872d6ff3247366481828e0659703507878ed3dd210

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
56e50d11d7d3b4bce806dfa24df767cb

SHA1
ee71444e71f0955d357b5741cccc174fcf774cdb

SHA256
135aad8b88ef043e63cb932086a9fda96b1048420710408d58906476e8d10e0b

SHA512
5eb9fc9cfe2b16d13062f3eab7b4f0ce5e0be7a62d601f7deb85414221493d2cefd6a60e8ba671a8fb71ff522d75f65f3d3a9fba0811a9a8817ef9b6ea58599a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a47ebb2784d42935833260df060b7a5d

SHA1
2b6abd839cc95309a2f2f493b042c5139931d364

SHA256
d050e69ee9270f50809785dc949ab8ef61f403ff1b6682ef63fd21619617c2f9

SHA512
419d20e4b24d3052da769d59805dd7ceffbde9e5c0c724dfe4ec1659dce60586cea36078d60785318739daa50e29c4799a39942081f4215191ffe3f166832dcc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
f5b764fa779a5880b1fbe26496fe2448

SHA1
aa46339e9208e7218fb66b15e62324eb1c0722e8

SHA256
97de05bd79a3fd624c0d06f4cb63c244b20a035308ab249a5ef3e503a9338f3d

SHA512
5bfc27e6164bcd0e42cd9aec04ba6bf3a82113ba4ad85aa5d34a550266e20ea6a6e55550ae669af4c2091319e505e1309d27b7c50269c157da0f004d246fe745

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
56a93b6206f9a97ab27c8154e41dbe1f

SHA1
1b4d06e465136af1dce50ed62d23577e0639786d

SHA256
d85bad54edde5167e3ab657fb8a9e24664f198427ac9479f83553269d20c9b63

SHA512
8be43451c58d38d1e87febfbc9591c7d7bd5d01ccd78a01baf1b03562b44a8b7029e9ce6caaef39de8e2c35b585e707dc470799589ad0d91b623676a9ba6be33

Download Submit
C:\WINDOWS\SysWOW64\config\2.vbs

Filesize
1KB

MD5
b904f719c648bf0f386746918dbc9738

SHA1
f3b0764e008a0a4dcf7813157ffa8ec39749fd24

SHA256
9c226d1fa37bb550a2df2974d77b00931d2aa9012c82e5c78ef6d7805959c551

SHA512
3b6454e25f2e041bc94ac8ac766eb65a830b504d8ae9011701ceed336e170b72299ddbfb412dba2a12839555d76e6d492a24d6adc87a25fe249fd707edb9d8a2

Download Submit
memory/3548-5-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download