f9753221feec9d106c5ad16120eb8bf9a6fcee1625d870373de7496cdccf4a4d

Resubmissions

09/03/2024, 02:23

240309-cvgk7sbf631

09/03/2024, 02:23

240309-cvcbgsbf571

Analysis

max time kernel
1774s
max time network
1685s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/03/2024, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a.htm
Size 1KB
Sample240309-cvcbgsbf57
SHA256 f9753221feec9d106c5ad16120eb8bf9a6fcee1625d870373de7496cdccf4a4d
MD5 752a1a8e638938f8e466e838b330f7b1
SHA1 5a66c6f7dc710496af18360253677a62a5bc260b
SHA512 e6f1333f3303b5c30e59e13baba529279fadb5a83b3984f0f83bffd69978146e062ab82a01e04fd7af2bed8a85aa6512acaebf24604c02a317ed8b633d736c43
MD5 SHA1 SHA512

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2232	msedge.exe
2232	msedge.exe
4808	msedge.exe
4808	msedge.exe
3180	identity_helper.exe
3180	identity_helper.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe
1700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeManageVolumePrivilege	2036	svchost.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 2720	4808	msedge.exe	88
PID 4808 wrote to memory of 2720	4808	msedge.exe	88
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 1280	4808	msedge.exe	89
PID 4808 wrote to memory of 2232	4808	msedge.exe	90
PID 4808 wrote to memory of 2232	4808	msedge.exe	90
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91
PID 4808 wrote to memory of 1840	4808	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a.htm
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffac72346f8,0x7ffac7234708,0x7ffac7234718
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,12534827945561839434,7273813446318049650,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4412

C:\Windows\system32\rundll32.exe
"C:\Windows\system32\rundll32.exe" "C:\Windows\SYSTEM32\EDGEHTML.dll",#141 Microsoft.VCLibs.140.00_8wekyb3d8bbwe
1⤵
PID:5520

C:\Windows\System32\svchost.exe
C:\Windows\System32\svchost.exe -k UnistackSvcGroup
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 3a654b499247e59e34040f3b192a0069e8f3904e2398cbed90e86d981378e8bc
MD5 9ffb5f81e8eccd0963c46cbfea1abc20
SHA1 a02a610afd3543de215565bc488a4343bb5c1a59
SHA512 2d21e18ef3f800e6e43b8cf03639d04510433c04215923f5a96432a8aa361fdda282cd444210150d9dbf8f028825d5bc8a451fd53bd3e0c9528eeb80d6e86597
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 4c0224fb7cc26ccf74f5be586f18401db57cce935c767a446659b828a7b5ee60
MD5 e1b45169ebca0dceadb0f45697799d62
SHA1 803604277318898e6f5c6fb92270ca83b5609cd5
SHA512 357965b8d5cfaf773dbd9b371d7e308d1c86a6c428e542adbfe6bac34a7d2061d0a2f59e84e5b42768930e9b109e9e9f2a87e95cf26b3a69cbff05654ee42b4e
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 5588b32cdc057bda7d917b7990b71e93d815a949827386d1780a29abc90e0089
MD5 c778dcaa62dc1e53c3bd35a34287cd72
SHA1 850d9e3c00172c0a88b0650df5cc4af006bda2a1
SHA512 c6e28afd20b16314d9c7ddf9574512825558df6f785e01b7bcb08e2af8cf8f7dec6e710b5d3bbe15629a1edf992db9e53e852ff8ae7e8d22fdabd66fdfb84ee2
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 340B
SHA256 2ec2a8444c50ccc54454d9216d6bc20259eded16f17bc789b8a12c7f1538fa61
MD5 c32f166681915b30f1b1d518bbdbba25
SHA1 aa5c4573ef1cb73c22c79d341eae6bb1384312e1
SHA512 762a5d9776a4e7f08356eff9ca74ebfd2b3499438766c58fe9f9c85fa77a6159c81e96164590c608b71b7f694a93dadb844adf8ebd7eacbde1c44fd0b2383b27
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7d5e18c137034cb03a3e7b32ce1849a92c0d395ae528020f2f7bb4b3ad78b246
MD5 40b4d33d88a04138f5273f3ac492169f
SHA1 c13de4e47b1a7cf0c9aaf19bf87a76fa423c3be2
SHA512 2c78ff245767caecf349b61b0764e505ba8aae0027f77b90eb7162e3fdbe62ae34b70c47648404288081a7832916fb9fbf49b8a5f9e0c186c61e0267585bb549
SSDEEP 96:n5kbk2Q1F2wpvWMoiVmdeHOHTsXUWQyV+VD7ziEwb:n5kg2QL2GWMXETurt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 28dd0c6b06d8fd6dee9269ef43c5c1aae81beab2cab7222295f11ba3b37090cb
MD5 1d1857f2b28bd3a993ace495c8c5f68f
SHA1 08619db6b773ac95637f7ab837a46329824efbcc
SHA512 acb52d7ccc407b340e4aed6d5099064a4962de7c90ec6d1457e5e978b3213a8d2a8e29bf16038200d160ed64ea3b11f470ffa147f52fdc8419348d310bd57dbb
SSDEEP 96:n5kgk2Q1F2wpP1WMoiVmdeHOHTsXUWQyV+VD7AiEwb:n5kH2QL2q1WMXETurg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 006dd30972967d1e9c3ded4c0cc955e23617ba8ab67f6c4aea0ccc2c826e7ab0
MD5 a0dd4f208ff0a50ff0fb56af7d775461
SHA1 8846f56a4db9d67a19acb9ad4ca2c79970a41a9c
SHA512 e02b98babdae1550d86471cf8c13c42d6e9a09f8d76f6d7986b53ca49b25352f36db1508e2c111b5034dfa06d6d44e3bfa0bdf925f833dc9914613391c6cf71b
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 9c74a2f2bba4455a82c008580f849dd265ba0b7121de1b90fd3a6d0bf96cd896
MD5 ef832d065fd9cf03db74b11ddc111b58
SHA1 9844549c9b59defd2c883962ca683c3332279d75
SHA512 12281a8e911e7d1adb583f5841741bbc75c4947763e7627c28ac913e69d2d40c6ab585653b8ad9258b3c20dbcbfe7a24a6f02b9f8dafbc79552204760344a3e4
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 ceb80e542ab2226662057f75735f94a647835dba3f792279e30d90230e39179d
MD5 b533c98e79ca70b6b1ad2a9b058df29a
SHA1 9717a2b328000904a02a65af69dee14be68d7d4e
SHA512 2d02cb404986780682d2f18f08201ecf34c13d833c491c5dad8c99343c9d650fd3320405a83d602a7a33e661d833bd05ee822341b8214d4f5e31b1907970ef97
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 785828e05799c37edef8cede59f1b20f32c4deb341ff3cd8c7d05a0616185ce6
MD5 712803dbe7356c394da63079cca15f23
SHA1 10001b8650be1d7cfd301c1bf867c6ed259da4ff
SHA512 a2b40b1fa0ffe62da279f6ef9fa421e6a56a9a670542d538d7eafd5fd480f4fcaf72b9bfe567332c1c8bf2ec8877b2d4bf2a7313099548d9e2c336c51e2851f9
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 319ae19f93212a877f0f40157995a20cd79f6a1c9ef46c6b7bf5d394e9aac9e5
MD5 0db392acc8fa48a2d94e7eb7233e799d
SHA1 f654f68ebd9f0692d3d5ab5c799b74cb5271e3d5
SHA512 7be4ea4de4580488b8b1bceb1e4dfc2d8121e6f400f590e484a65c4df655316e64027d45b2cf7543c96252cab388e82c74354637a4edbaf1a8747f90970f3347
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 53ae4db8b38f187475de5ad12f699678a54e7aae61019452bfc2877c198ccb4a
MD5 8f714077511b10ebb4f5e49a7d3c4593
SHA1 41b0e4fc14064f13356e0b7c47118381b829bee2
SHA512 9ce19404f4db6d38b4d032f6fb4356d26c3e7cb7a8904b256e00817fcbd446818f7116200809ca3964449481b0e4dbd1199a79b9c35b5780b1a5fff758eb8e06
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 538B
SHA256 a01a752b32d8149e00c3ff37365e73f66c35a96d09429440d6d5f0959eb7adc2
MD5 06c53653c6287a032c323acf8416ed14
SHA1 dfa084f2f00c2359702fce07b69373cec0699aa0
SHA512 2ffd07a0d13040fbee436909d67b4c864adc313950669508a55d38f89665341ee75667294dc2b792b442ffb20b242e0b14dde28901d34fea1f17037d1fba99d9
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d7c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d7c2.TMP
Size 538B
SHA256 00f351222d80f0b12ca4a45788f9f694ed607d3d09e0b9dfe15ce53f04b27a34
MD5 5b8588a5256135e8e30b74328a152248
SHA1 f45e2f2c1165790a770bfb87b5d9e5ca54a77d8b
SHA512 9e58796dfd525441f5f5de5a8339653af64a7d9d18edcbb3753233c3fd7b5e05172dc01c9b957b9c5b5ff1c57e58f7d9719c322614daab1f625c1ebe0459bfa6
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d60942f4240c146825f50818174f528c2fc7530178fb55b4088f50f3c9e5d2df
MD5 96954e4ea9acb027f14503c349ba8310
SHA1 56adea9891a729e4e9c9a38ce372f1255770adcc
SHA512 fb2fedac8fb8ebb5fee2071e519673ffbaaf323f0de8d6c4e84c2aa0798d36201efdabfc1a3cc64f4fdbeeb41f7ff528c83e423a9c2d538faa797a8952f0d3bb
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupPe2RUAybRV9xUX1MPeuu0s:A9iIxuERzA83h09RZxY3MV9E1MeuBOQ8
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2036-210-0x000001F90D4B0000-0x000001F90D4B1000-memory.dmp

Download

memory/2036-209-0x000001F90D3A0000-0x000001F90D3A1000-memory.dmp

Download

memory/2036-208-0x000001F90D3C0000-0x000001F90D3C1000-memory.dmp

Download

memory/2036-206-0x000001F90D370000-0x000001F90D371000-memory.dmp

Download

memory/2036-190-0x000001F905040000-0x000001F905050000-memory.dmp

Download

memory/2036-174-0x000001F904F40000-0x000001F904F50000-memory.dmp

Download