6ebe96d8fde46376047bdfed5a913f0729630907ab1f74b2ac1583dca3659aa5

Analysis

max time kernel
146s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2024, 00:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9c7a85650cf2fb1648dab11d38cdaa30.html
Size 68KB
Sample240215-ardzssdc87
SHA256 6ebe96d8fde46376047bdfed5a913f0729630907ab1f74b2ac1583dca3659aa5
MD5 9c7a85650cf2fb1648dab11d38cdaa30
SHA1 098d8c9d6fddd9fee268e2879cf8e5afb3c17553
SHA512 5eeeb679b952046c76f8ce786c48b72ad39a47f06d6b75cf9f5c716d3848aea4963f3684a42484cad531777d18e2e3a8e996f9690c1a0e06f6c83613f0409c6f
SSDEEP 1536:zLfxCZb5Udcf3onzkvDSzg1AJSetxzDBc:vfxCDUqo4Dmg/etxzDBc
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
2200	msedge.exe
2200	msedge.exe
3204	identity_helper.exe
3204	identity_helper.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe
3272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 2096	2200	msedge.exe	70
PID 2200 wrote to memory of 2096	2200	msedge.exe	70
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 536	2200	msedge.exe	85
PID 2200 wrote to memory of 4628	2200	msedge.exe	86
PID 2200 wrote to memory of 4628	2200	msedge.exe	86
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87
PID 2200 wrote to memory of 1588	2200	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9c7a85650cf2fb1648dab11d38cdaa30.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a6ed46f8,0x7ff9a6ed4708,0x7ff9a6ed4718
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2268 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,5392746096667248912,11714833836354783374,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3588

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2680

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 32dd52cc3142b6e758bd60adead81925515b31581437472d1f61bdeda24d5424
MD5 84381d71cf667d9a138ea03b3283aea5
SHA1 33dfc8a32806beaaafaec25850b217c856ce6c7b
SHA512 469bfac06152c8b0a82de28e01f7ed36dc27427205830100b1416b7cd8d481f5c4369e2ba89ef1fdd932aaf17289a8e4ede303393feab25afc1158cb931d23a3
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 312c873b8629ac0c3224335cc2afa18ab06b49bf2f408f264f9a4ed5f7594428
MD5 ad3625de0d3e7b7f4d44d1caa3d61d6e
SHA1 a78336ef73a1a2d8b213b61fe0c6c77cfd3d73c3
SHA512 b9995f571bcd90e8b8bd9029513a5018d4c04cae11576927651d8d79f7031cf610aa0d4895ec4885a9fdf06dab3037c87956fca9edb1172f408d3cf6712515da
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 962B
SHA256 9c7946cb7cd8eb2e0683f7d826ecf590598d6148061becaf539f2b5c93d68893
MD5 49dbfd002d04e277d87cfd5964689e67
SHA1 2b644a3e28eef30cb23086d6b381d9641c97e7b0
SHA512 93cc5b0c6b5a008c96541fe966b32d4a390384db966afd575f8846f194f3123c57538d02361db53f0e9a66b9dc81103250121b0b456d1eff2f29b8e95500bcf5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6de5a2da29c41e2f110e339b0ffde2a99d61341261a9606f20fd07ffc21be6fb
MD5 dbab616ad8cba90cb5c311973564d1d7
SHA1 18247dc023e1965161c88f069906c85a41abfb64
SHA512 4545e139994d3056d910019f7061ab3dd02bdc4b71131b7a36f2dcb4824bbe30d71b3d6db5cd2e75fff1575c39f3d901e55ea58efda28488d02e92237fe597d5
SSDEEP 96:nekFi1CARMwpvWMoiVmdeyUfw4eH2eDSr/UWQyV+VDCAiEwb:nekMkA2GWMLfw4eH2B/rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 58638c86780862bf75377ab3b512d139223f1689360f86b9a96ae2651fac448c
MD5 ccf96e48cf6a7ef7f75c094cdf665910
SHA1 ebd4a289d3abd88c717cc98b977ee11edf859912
SHA512 e60f0038da8dd792d333d6c4a601c790cb58d07685248c24429d63edab8b4899d5bccfbfefcd91bcedf04da3d49eb9d739eb6a73a9f2325281c4de005afc4154
SSDEEP 96:nskOi1CnMwpvWMoiVmdeHeDW/UWQyV+VDCzia:nskhkMGWMXN/rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f0f4a3a4579afb9121babd212958dbfbb9ad4e8b6bae745026ba6ab2cabbdc3e
MD5 a7a2e63bf63eaad23c2b89372a56d34f
SHA1 a84bfd9e594b95110a9256327df6dfd0ba4abc54
SHA512 1f7c9c273600a127e66ef18bf8864b0ca61db50bbab1a6b7440b16790dd002b4248cb71d0b7845d6e08e48fd469d57030f49662b92de84a8cbe2eefedc99c300
SSDEEP 96:nekdi1CARMwpvWMoiVmdeyUfw4eH2eDSr/UWQyV+VD7AiEwb:nekEkA2GWMLfw4eH2B/rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 f0be4c5c99b216083bd9ee878f355e1aa508f94feb14aeebcfba4648d85563a7
MD5 35f77ec6332f541cd8469e0d77af0959
SHA1 abaec73284cee460025c6fcbe3b4d9b6c00f628c
SHA512 e0497dbe48503ebbf6a3c9d188b9637f80bccf9611a9e663d9e4493912d398c6b2a9eab3f506e5b524b3dabbca7bb5a88f882a117b03a3b39f43f291b59870c8
SSDEEP 768:nysWEQ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGLltHrUFo4:nysWEQu1jaLLse4
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 ddb346882287d5a697033de751fc809e98d96d2e7e61b0185a458c750c87e0d9
MD5 fc96d18661c13f2bbeddf63f3942f8fe
SHA1 034b4fe1d2c5dde357106a51ffd4356085c014c7
SHA512 1abd559f349124b304d8be287ede67e2bc36676aba56b17efe545d743a20b9fa5165a564e0d8df998c9af0e0cffd66da7410e951a870c5d810e22a121c72f217
SSDEEP 192:DoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupfN/z4ge2RUqStwy1hTw8At:j9iIxuERzA83h09RZxYfN/c+vPyI86WK
MD5 SHA1 SHA512 SSDEEP

Submit Download