f271c8f134130fbfe0655f50ebf35d421d0dde39371d8f89816e736e447f5689

Analysis

max time kernel
150s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
06/03/2024, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
MHPT v7 Injector.exe
Size 982KB
Sample240306-vcx5cach37
SHA256 17e33d0df88ff540b77c81b73947a9dc311abedd625df1ed5816212cba47a19d
MD5 b29abaf19505a62664666efd73df99e3
SHA1 e5059b700badfdda391be5596fa0331bff589a91
SHA512 76ac2ca0a4c9966ac206f9ba1642d17db5ac6987df814f40e35afa34e19b2cccf4fd57e884b88ce2c23f54670fee1b911eac7edc0bcb5915991f11625089d263
SSDEEP 24576:M2RTaadusUHHSAutT1HLeuEfwBwaPT9aOuzA1W:MWTBusUHH/utRerwPT9fun
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

evasion

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	MHPT v7 Injector.exe

Identifies Wine through registry keys 2 TTPs 1 IoCs

Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\USER\S-1-5-21-513485977-2495024337-1260977654-1000\Software\Wine	MHPT v7 Injector.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
4068	MHPT v7 Injector.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe
4068	MHPT v7 Injector.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe
2276	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4068 wrote to memory of 2276	4068	MHPT v7 Injector.exe	91
PID 4068 wrote to memory of 2276	4068	MHPT v7 Injector.exe	91
PID 2276 wrote to memory of 536	2276	msedge.exe	92
PID 2276 wrote to memory of 536	2276	msedge.exe	92
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 3884	2276	msedge.exe	93
PID 2276 wrote to memory of 2160	2276	msedge.exe	94
PID 2276 wrote to memory of 2160	2276	msedge.exe	94
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95
PID 2276 wrote to memory of 4804	2276	msedge.exe	95

C:\Users\Admin\AppData\Local\Temp\MHPT v7 Injector.exe
"C:\Users\Admin\AppData\Local\Temp\MHPT v7 Injector.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.mundohackpt.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff3cfb46f8,0x7fff3cfb4708,0x7fff3cfb4718
    3⤵
    PID:536
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
    3⤵
    PID:3884
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
    3⤵
    PID:2160
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
    3⤵
    PID:4804
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
    3⤵
    PID:5060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
    3⤵
    PID:3720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4004 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:1868
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 /prefetch:8
    3⤵
    PID:4172
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4132 /prefetch:8
    3⤵
    PID:2332
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4164 /prefetch:1
    3⤵
    PID:4000
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
    3⤵
    PID:2792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
    3⤵
    PID:3572
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:2724
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
    3⤵
    PID:4240
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1048 /prefetch:1
    3⤵
    PID:5308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6011534928975434479,14775612307768590292,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5608 /prefetch:2
    3⤵
    PID:4348

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:764

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32
MD5 5c6aef82e50d05ffc0cf52a6c6d69c91
SHA1 c203efe5b45b0630fee7bd364fe7d63b769e2351
SHA512 77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2
MD5 7c6136bc98a5aedca2ea3004e9fbe67d
SHA1 74318d997f4c9c351eef86d040bc9b085ce1ad4f
SHA512 2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 905f6dff7a59353e89eaea47a2f78d599858cb1994475b0cfb3a0d87760d7d0b
MD5 f5fe44c6aeb1a92e3abf3032288bebf4
SHA1 085d614e1773df0ddc71386b012879bc503bd501
SHA512 0bff094809311790dafc594ac4fc38d33745291af4269859ba8f4b08d14082dee814903893cbe88cf95652da85c63a262c1b6e9187456a54d53c335ac3a65deb
SSDEEP 96:n9kExm/KQYmqmQ1lsDLJwpvWMoiVmdeHqqESUWQyV+VD7ziEwb:n9kdTlQ7sLJGWMXmSrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 79a2fdf8aff8eb8185105636c6ea4c3649e467381eb97354649cb7ec30f4a56d
MD5 27287cf58b68cdcb57d9ba5bf69f69f5
SHA1 0bcccd14ebadccd41bbd2470aea7751201eff1ea
SHA512 ecd5aefcd5bf5ac20fe6efb179bdf2ea6674fb77518e455c4f8292adede62686746e14e565114408c1d374f2c00cba92606ec1997fa45ae6a5b106e1f7989ebb
SSDEEP 96:n9kExm/KnmqmQ1tsDLJwpvWMoiVmdeHqqESUWQyV+VD7AiEwb:n9kd1lQHsLJGWMXmSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2989366d5a81aa753ceb034e42760cf5a7920bbcce778389523f84ca70f86fb8
MD5 7173c875cef872efc5c75b3181c3172e
SHA1 1a77c5d283f58b9a44fa5a148af1445a439110ce
SHA512 0c9b6e000701cc3ba04613d9158217cf765ce7fa44c79cc30a2010b480dfd2065c6c0dcd43d0af86be13d1cd4b625e0548f2e01db86296943d5c22c3341b6a24
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupKmte2RUmqbfT9xUX1MPeuf:A9iIxuERzA83h09RZxY9poT9E1MeuBOO
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4068-13-0x0000000004700000-0x0000000004701000-memory.dmp

Download

memory/4068-32-0x0000000004770000-0x0000000004771000-memory.dmp

Download

memory/4068-10-0x0000000004760000-0x0000000004761000-memory.dmp

Download

memory/4068-11-0x00000000047E0000-0x00000000047E1000-memory.dmp

Download

memory/4068-12-0x0000000004830000-0x0000000004831000-memory.dmp

Download

memory/4068-6-0x00000000046B0000-0x00000000046B1000-memory.dmp

Download

memory/4068-0-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-14-0x0000000004790000-0x0000000004791000-memory.dmp

Download

memory/4068-15-0x0000000004840000-0x0000000004841000-memory.dmp

Download

memory/4068-17-0x0000000004970000-0x0000000004972000-memory.dmp

Download

memory/4068-16-0x00000000047F0000-0x00000000047F1000-memory.dmp

Download

memory/4068-18-0x00000000047D0000-0x00000000047D1000-memory.dmp

Download

memory/4068-19-0x0000000004670000-0x0000000004671000-memory.dmp

Download

memory/4068-20-0x00000000047C0000-0x00000000047C1000-memory.dmp

Download

memory/4068-21-0x0000000004850000-0x0000000004851000-memory.dmp

Download

memory/4068-23-0x00000000047B0000-0x00000000047B1000-memory.dmp

Download

memory/4068-22-0x0000000004750000-0x0000000004751000-memory.dmp

Download

memory/4068-25-0x0000000004860000-0x0000000004861000-memory.dmp

Download

memory/4068-24-0x0000000004870000-0x0000000004871000-memory.dmp

Download

memory/4068-26-0x0000000004810000-0x0000000004811000-memory.dmp

Download

memory/4068-27-0x0000000004880000-0x0000000004881000-memory.dmp

Download

memory/4068-28-0x0000000004730000-0x0000000004731000-memory.dmp

Download

memory/4068-30-0x0000000004800000-0x0000000004801000-memory.dmp

Download

memory/4068-9-0x0000000004710000-0x0000000004711000-memory.dmp

Download

memory/4068-31-0x0000000004780000-0x0000000004781000-memory.dmp

Download

memory/4068-7-0x00000000046C0000-0x00000000046C1000-memory.dmp

Download

memory/4068-8-0x0000000004740000-0x0000000004741000-memory.dmp

Download

memory/4068-5-0x00000000046D0000-0x00000000046D2000-memory.dmp

Download

memory/4068-50-0x00000000048D0000-0x00000000048D2000-memory.dmp

Download

memory/4068-4-0x00000000046E0000-0x00000000046E1000-memory.dmp

Download

memory/4068-3-0x00000000046F0000-0x00000000046F1000-memory.dmp

Download

memory/4068-72-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-2-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-1-0x0000000077694000-0x0000000077696000-memory.dmp

Download

memory/4068-89-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-90-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-100-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-103-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-104-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-114-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-119-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-138-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-139-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-140-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-152-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-153-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-156-0x0000000000400000-0x0000000000606000-memory.dmp

Download

memory/4068-159-0x0000000000400000-0x0000000000606000-memory.dmp

Download