aa20e0f72bf612533f6b76fa220eb1a12150db24137713dd3d3ccef14a426f47

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
15/02/2024, 07:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
9d42cf9cb7797800501547535516c39f.html
Size 183KB
Sample240215-hs47dabd51
SHA256 aa20e0f72bf612533f6b76fa220eb1a12150db24137713dd3d3ccef14a426f47
MD5 9d42cf9cb7797800501547535516c39f
SHA1 2122aa500478f0441272885a397f8f86cc8fbe8e
SHA512 188c824f885d286216f222762d71e81ee9cb2f5769b5b92b56a0756ec7be4e1531dfd08a421fce0a4ce17a13fedec0b3a15dd56b483f603089d2747de0665c84
SSDEEP 1536:Y9cPH6xacK8W/MPe8rVKy5xP6JEYx6LOndji6OOxD7Nnq4v0+sxdEnUX4gs2+s2X:8SmacK/86JBq6p7Rq+U9Us00ZwlWuB5
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4332	msedge.exe
4332	msedge.exe
4928	msedge.exe
4928	msedge.exe
3292	identity_helper.exe
3292	identity_helper.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe
4928	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 2600	4928	msedge.exe	83
PID 4928 wrote to memory of 2600	4928	msedge.exe	83
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 3196	4928	msedge.exe	84
PID 4928 wrote to memory of 4332	4928	msedge.exe	85
PID 4928 wrote to memory of 4332	4928	msedge.exe	85
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86
PID 4928 wrote to memory of 2036	4928	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9d42cf9cb7797800501547535516c39f.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffffbc546f8,0x7ffffbc54708,0x7ffffbc54718
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2664 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,13284556258683699779,11672433646707180809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 92b4c004a9ec97ccf7a19955926982bac099f3b438cd46063bb9bf5ac7814a4b
MD5 7a5862a0ca86c0a4e8e0b30261858e1f
SHA1 ee490d28e155806d255e0f17be72509be750bf97
SHA512 0089df12ed908b4925ba838e07128987afe1c9235097b62855122a03ca6d34d7c75fe4c30e68581c946b77252e7edf1dd66481e20c0a9cccd37e0a4fe4f0a6fe
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 dc870e9011c9db1024918f88c519e475e45f540a2fb4f567d9dc281efc221fca
MD5 a36c6b0e0744aac5b5d1bc3375e33f98
SHA1 9a475a67be69c4d0d3eff2151c8141655d6ec574
SHA512 b0f645fbda877e55ae854c03edb4c0de4e508879d604fd7cc0e4a583dfa32f17183c1792ce185e6bb36f065dde96e289030e5e4e8d9a1059afef720859cf3a3c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b0b0fdc58da4dd8f777dbb9014e6ba64ce34dc75f0b5591c1b057210a5df9736
MD5 f79b301660ba04199faa26f188b18009
SHA1 3532ccbddc4a6a8e0c38a3958040f7dacf469dee
SHA512 7b82232323a5f69633c164f886e0e3e38447cae348a2e48efea563d19d13f343ddeab495ed10db6e9697c7d03838df7249f28e7f7375e0865a9c6b1d581cbb0b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 2bf84910d3d1e00f458f44f8c60a06e64d6f162b461bd19df99a7ae8fc5adaa5
MD5 f921d76b898cd70454e002507436446c
SHA1 831895a55b85e0df0dafdca03b23bc829403b20c
SHA512 58c552d4e2bb7a1094835735fb4b3fea71fd1de1dae8ee45c32f78e10ca7e76aea206839eb77fc6623795390c3a4aee642cb727ac5b69e4e638c25ba40ee206f
SSDEEP 96:nLkFL1z6wpvWMoiVmdeMi92kOGUWQyV+VDCAiEwb:nLkZd6GWMci926rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7de9506d937118d55ed2a7ee4559fe0cdf17da260a9f6d62052e8fa9d96437a7
MD5 8e936eb5a71dde8d647cd780b47488e9
SHA1 fd1ce3557c9442ca6871b32e6aac665766b36f44
SHA512 629fa57efa799945002b5afaf149afeb0ec6319f166aaa8795191d01cff1f1269ae457fc8d865ef488e27350ba665bb2bb635b26935aa5f9857e4ea4c8058d5d
SSDEEP 96:nLkdL1zFYwpvWMoiVmdeMiq92k0GUWQyV+VD7AiEwb:nLkxdFYGWMciq92krg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 0899f2f8cc27da72d3ca22d8fa466a9d131e41fd4f8b152d61a450d181c07486
MD5 7a96c5cca19b8894caa5e691ad19d6b3
SHA1 22e6c2c791dbb8bb265cb7585aa806b2c9b483a0
SHA512 15db67bf6cd00c3fb56edc8f163d07eef237aef5ec549dc1102ffc50d2885b80d03499ba7d4487173da82afa4f81aa7440b82011989a736aec6d53d4d13ea444
SSDEEP 96:nhkOL1z6wpvWMoiVmdeHklUWQyV+VDCzia:nhk0d6GWMXGrj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a97f601dbeb463993cb774f95bf61a4a30dfdd7d14fd767ba41bcc1e52e3ff8f
MD5 08c0a358b6023d8f67d1e735a8261fc1
SHA1 c16ef0cb62827580447f9d25989902a1abc7668f
SHA512 b08c6721f43a0e98fc7b43df2d63a6779178ca57f5b9ab4d1e1050f3b0c8d74bfb7a629294229b939f23ffa60b69e3af7eb851f2b91b8445a70504358c3eb254
SSDEEP 96:nLkFL1zFYwpvWMoiVmdeMiq92kOGUWQyV+VDCAiEwb:nLkZdFYGWMciq926rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 98fc43994599573e7181c849e5865f23b4f05f85c1115dff53c58764d80373fb
MD5 52826cef6409f67b78148b75e442b5ea
SHA1 a675db110aae767f5910511751cc3992cddcc393
SHA512 f18df18cab6b5ecd71b79c81a2a1fdac42cc9960f62f06ac25f4d6487792705f2766ee3a10239eaac940d090186e6bc820e4eb7a5ee138f6e5c1c64f951b960c
SSDEEP 768:nXwWPv8F1+UoAYDCx9Tuqh0VfUC9xbog/OV2LlxQrUEYtLAO:nXwWPvu1jafLzPtcO
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 fe67d027a4d1aa0789cecb887fcd905c4c7bb7f1d368b2e854e59caa9fd95537
MD5 fd7f2dd9e61d5e0c6853e2b1f56edc08
SHA1 bc5270da2cd6c4651a3fe982346aa2aeb14f2b02
SHA512 0eb3462bbc1d264d9be1c4a952470582d529e23ce0fdf206f5fec0b571621722df72f3b0f3a025fe2be033466111190c6e099168723fe2168e36c165fe4ed075
SSDEEP 192:ioCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupkTe2RUfapSFhTw8AftwKCv:29iIxuERzA83h09RZxYCXS486W2g
MD5 SHA1 SHA512 SSDEEP

Submit Download