hxxps://mhme[.]nu/design/7487ef6a-9c27-4e53-9daa-683f0d1bbfa4

Analysis

max time kernel
145s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02/04/2024, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mhme.nu/design/7487ef6a-9c27-4e53-9daa-683f0d1bbfa4
Sample240402-qdwkpaba64

Score

6^/10

amazon phishing

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
330	yandex.com
332	yandex.com

Detected potential entity reuse from brand amazon.
phishing amazon

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1497073144-2389943819-3385106915-1000\{BFBACBAE-730C-45D6-927B-A040BF044FC1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3608	msedge.exe
3608	msedge.exe
2932	msedge.exe
2932	msedge.exe
2720	identity_helper.exe
2720	identity_helper.exe
2220	msedge.exe
2220	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe
928	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe
2932	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1452	2932	msedge.exe	85
PID 2932 wrote to memory of 1452	2932	msedge.exe	85
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 4672	2932	msedge.exe	86
PID 2932 wrote to memory of 3608	2932	msedge.exe	87
PID 2932 wrote to memory of 3608	2932	msedge.exe	87
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88
PID 2932 wrote to memory of 384	2932	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://mhme.nu/design/7487ef6a-9c27-4e53-9daa-683f0d1bbfa4
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc96ae46f8,0x7ffc96ae4708,0x7ffc96ae4718
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3108 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6744 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1740 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=7132 /prefetch:8
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=7160 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,17590671117000948446,944313860522486783,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6472 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:928

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93
MD5 4d6e17218d9a99976d1a14c6f6944c96
SHA1 9e54a19d6c61d99ac8759c5f07b2f0d5faab447f
SHA512 3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47
MD5 SHA1 SHA512

Submit Download

f_000063

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000063
Size 16KB
SHA256 02c1373bcff83e1ed8bfafd3aa2a7ffd4bce9db8aac6447e60bc564364f03812
MD5 3906285ceb0e3a0595c1c19c0f2a6dbd
SHA1 6ea57a2f5304daa751e2d7ce575c429903853a08
SHA512 01c95accff44360f5c3c8896a081391be4eefaf726f7aeec6ae552801a6769be0de87c507f21e8c7392d7478b53529fdd51e310366e19ff118e40abdee798f98
SSDEEP 384:C9oG0mWZFbpNutJTXer0NZ3pZz3KVP11qFx0E67NDxHKl8iP1Byd475g:6QFbpolZ3ngOFx0EazHy8itgOg
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000066
Size 18KB
SHA256 48d0762e1a32368f20cd7ff1bc33cfe27646ca3d85e0e3197bfdbb3bbaf650cd
MD5 0e24cb34a256208613a75cebb7a7b561
SHA1 15fd2d4f2d7e759dc641c30b9f4a7d86d4ec53a7
SHA512 a5991dda535f689768a7671c215c9776f7e5d468af1e6095ee9ac24c80daa1a6f351a5c71eb286846158759f744c5e8c657fdec7cee22fba36f9c552f55504e2
SSDEEP 384:3XcwLqcJzso9+/zY0Eql6DPgxhA6y00LEAB9K5UIGO:3X0c8/80Jl6DGAh00LE/53H
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000067
Size 75KB
SHA256 35b85d972fc67f2f3791c436bc6fb32b5ec18805e26577722853b7b1c1fc64e9
MD5 5316566379eed5d3f4868d1d63795e02
SHA1 0762560e1b7eb640b69d94ef06aad3b91aaebb38
SHA512 a80510ded31e5ccd4beffaf374bdc47cb5e6cee7e06c2ff8b46e68be445fc79923ec36076bca08ce9234a5143b119bd5d7dba209ca42115cc7bb640adbe9d158
SSDEEP 1536:/DE/9skLb94cDu2Bwdt+ppQ9tZk1qKg4QRoecS5qFOGke+Z4ePkNQfo9y4:rguCyPdgQTZk1qKgjUSEkvJpq
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 936B
SHA256 7afaa3f3bad2125d194f6b53481233a1e31818161b50f0c30d5b8c494317141b
MD5 fbe628e7818e0748c93d91ca7b5cdb95
SHA1 78c8f9015465d1c7b196b0c60d463dcf95227be0
SHA512 87f41bd5019b12d5aa56df2a2399aea1b3c5c7ef71ba2f46b2ba4ce7b80070f8cfb6da61e552c6b4746a787421e26c81b6a33dd8c6609bfcb2ce7ef5eafbf281
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 86be690c38bfeaa61e366df8f3fe385c31a0905a0ff1e69bcc16a153a60ceff4
MD5 f7f712e988119f296146e2ae7dc9e850
SHA1 0772cef04746fe7e9cd04f2cbb75a9363285d541
SHA512 ded4033e24c7c94d3bf2e5e59c750efc9a034e1cff3dec918e7251103b8bd0768cd7946adbd9fc623466f0f87b164961b30c3152f2cb48b406bf8e8a32c1cb9a
SSDEEP 48:VNhd9J3tEMB41HE1id2hrlcQ+UhdeaK3Ga/9znMvYirfpznUOaRKpYj7BMAakbG:vpJ9LBE5UcOTKWa1znvirGOkEwBakbG
MD5 SHA1 SHA512 SSDEEP

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\Origins\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 9KB
SHA256 9cb4cc4d95c3a61bf01095c48cff76f566ca37bd99fc545985b0c46a97c77afd
MD5 7e7e05d3257d58e4bf2b728ef05e1206
SHA1 bc43279a6d43c2415be00fe5c1c68bde02abeabb
SHA512 1e7b3f54ac49f67152e5ecdf862b391586105289d36100e948163b71bdbbc1520241557ddb42430e9743064ea89a5834bf40562f5511264c2a5f825f9e6eaefb
SSDEEP 192:TxFurZgI77hJuiOYlk6pwitliT9sP1LIIz8p6TxwQBfK9M+s6SfGm2jQY5sN1TiV:TxFuFgI77hJupYlk6pwitUT9sP1LIIzQ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 6KB
SHA256 a06baa12169098ba90f766977a6eb561d126eb5f5e41e8e9b628e2118059cf19
MD5 a172725f86c3e7b454426ef157a4c73e
SHA1 89ff7f92ac2f58be533f761adf4a01214f839cb7
SHA512 1c41ce4f926107b2a6f7c15edc112d8008f6cd5291b7d194da7dc2136e02c2187da4198b2884501d9ddc3b1a65bd7700e47c1a4aef79369c3837a1899ec50534
SSDEEP 192:TxFPTKFrVsagI77hJuiOYlk6pwitliT9wbBFsP1LwkIz8Bp6TxowQBfK9M+s6Sfh:TxFPTKFJsagI77hJupYlk6pwitUT9wbo
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6df69b2799a713e6cbc111414b24c34f5a0a1f3408226adc045b73c23480eece
MD5 c025e983a19b0d1c7be379ee942d1b74
SHA1 0e8fd7e63cfab8f5437bc97343d2315513f8b4f6
SHA512 bf1d210f12934e31de9e0379d565a44ce050ccb0f32aa587780d03332eeafccd43c218fa1e05832335878a7101a6e54abaaa4c7f1558e0824b572c7e0d1e66e5
SSDEEP 96:nykWpEt1tx3wpvWMoiVmdeKu61uzEgTi2PYSX+UWQyV+VD7AiEwb:nykFtfJGWMau6oYgTi2Px+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 63f6b4042d58ded0c297ac2e443267c3e30233d66fd988f33bd3be979ca020c8
MD5 3f298e3b54df12f053eed85b007dcb1a
SHA1 c1c458aeeb48b135a7abed8eac6b124bdec793fb
SHA512 1b704c9a1b2cdc6d121baf241ea4434cd33b347d538774b0e9bf17079486ff74f31ba19593f12c2a21010600582fe49193546ece2cca615883df2f02b7db74ac
SSDEEP 192:nykgtf8zwD9WMZebnGp6TfT/6xB6jqzi+vcqLqYgdW2vM0duuRWNFEt+IYAKEFSX:ny5fh9WRIBFcaAqP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cb1731169393fc89565ccfb0d1d37706a8dc352123a6e7c5884c887be4e4be5d
MD5 21f3efc292c821261c19acb7f6683b3a
SHA1 4e00dc6c7afdf459a8172cefe0a6e0b6574fea1e
SHA512 99729a7d7ea35225f5ca2785bdb7cd823d473b27cef5dfdfef45165f2ec8a39fc7b8a45a3d1752bd08eac39c4386e274d3d74f1a626219b3127983d8caade58d
SSDEEP 192:nykztfuzwUSiWMO3bnGdZi2LTOfni/6xB6jqzi++mcqLq4N/4/QL093qM0duuRWj:nyKfSWRu+BfQaAZJJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 4e8aa709173cdded7541432beb499e0ab5f7ed72d1d16e7e319dbd309c4284c1
MD5 5b97e096fe79e051a1b627c7d46b7914
SHA1 8ff68ecfaaa31a09bf08f6d64e6a30e7754d5d84
SHA512 175a1f2bf1f0d823c3a8b98991e8314b517c27eb325b65c0ceccd1d3d363ba756d4589dfaebac53cf23b2b6b439d96331913e7dbbc3970346e9e1e6a769396fe
SSDEEP 96:n4kBpEt1lh3wpvWMoiVmdeHPYJ+UWQyV+VDCzia:n4kUtD5GWMXPK+rj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 bc3f491f1f6c42ce8833c36b7fc5b76743340058f9e8893f56e308719d69e31b
MD5 dc01812c67366d9d61b5d6d240492a0a
SHA1 07bf1fd7fb028a421229c7eb8f14380c11517a64
SHA512 d9259c35b836026e5bf110f468bae22e5df33c64854f67a48fff45b80ae209786fdd1bbe880d72494e8bdcec997e972f4bf21296d891e5d08f8fce3cea519934
SSDEEP 192:nykTtfYGWM/wbnGp6TfT/6xB6jqzi+vcqLqYgdW2vM0duuRWNFEt+IYAKEFSoTik:nyofVW9IBFcaAvP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d72536c94a8a260cf95016bf65d43a2022abbe72ce7fbe2bbc8f353f68799539
MD5 37e2321c82f91a0492b34f68058a5747
SHA1 567bf6660957e2eb6d7a23db5c2f35ec3ec65922
SHA512 d90439e2a19af203f816ca338aa27f45ad222d2bd701416be020d4648f1c68caa6047d289409c889c28d56c685a6d2d4de4f64c815e0083b6210a03b28f2fa7d
SSDEEP 96:nykWpEt1tC3wpvWMoi/R5mdeKu61uzEgTi2PYSX+UWQyV+VD7AiEwb:nykFtfYGWM/Uu6oYgTi2Px+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521
MD5 c2ef1d773c3f6f230cedf469f7e34059
SHA1 e410764405adcfead3338c8d0b29371fd1a3f292
SHA512 2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549
SSDEEP 768:nFeW8o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOLl+YrU7C:nFeW8ou1jaTLI7C
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 2fc3c4e7656286cfa931c40f0cb04f19c80d7984387dd26d02277a5c6ed4d372
MD5 323f09ea6ef6da9eb42bb59eaa5b2cf3
SHA1 33ca39ad387e42d01d3996b19e3c102c13eef0a4
SHA512 c965716f5ccb877aa1c9328281e54841b6f38ceba87af7ddebad517b9f51635ad4568f57e9a44b628cd545ae9d11bd7ec7b5aa5d7845b3c9790e635cec3edad7
MD5 SHA1 SHA512

Submit Download

the-real-index~RFe579aaa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe579aaa.TMP
Size 48B
SHA256 d20e7a2b10530c9ad341b81d67ddccff2ad6763af14f98d85e7def1a6387b16d
MD5 b791468111cc3538813f82f1c6819e20
SHA1 a6327efd7d4fdb64217ce6d86d63abbd3960757c
SHA512 0a4af55ab6f0fd32ef77ed3c15518bff9673703314bb59ae964fa62f98cafa95e0e26519056935a76d57ef1ca74791fd420a62394cdc061307eaeeddeb83a614
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 6KB
SHA256 37df5c82dd99ede6e00b88935f0c70644993e799f4bd4ca9e1cc9365d0f997a7
MD5 6d7d5aed0e017c54d6fe98ddeaaa727b
SHA1 95de2d1e48473009cc88dc6c1e48d2cdc5d31f9b
SHA512 656d1cbdc0db9c20ff788cf99bc1256c5f079b14c19da47f1cb692612e0ecf8e2a4663684f53be8f6c4ee40501f489f9912f7b4223e8f58154fcac28d4a1498e
SSDEEP 192:JU8U2UmlUjqUGUdU+U0UGvUccUEUiU6GUYUlUbUFUyU3UNUvUQTeUCUaUzUbUY43:J33THnAn37vinp/G3gMstsAcM5B2ikK2
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 6KB
SHA256 17efdb02b99becc0a3fb172ce1261a135239e54caa31539770825d92073b6476
MD5 9e65e837ffabc959c4fb57aa64eae6bb
SHA1 fdbbfc961c20587b75a55dc0f8e0c8a944ace20e
SHA512 e439c22478a57e6b72f39f1cf141dc9154e3e8751c5302906232cddcbd947e5683de3663155892450fe28ed2119e08d31677bcfbdc191d5546d7cb2563fcf01b
SSDEEP 192:JU8U2U7qUGUdU+U0UGvUoUiU6GUYUlUbUFUyU3UNUvUQTeUCUaUzUbUY4KUjUCUG:J33jnAn37vDp/G3gMstsAcM5B2ikK09h
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 8KB
SHA256 67653492a309db03796f4f8311e0039ab87cdb017a21891abd624996a83c8ac2
MD5 0d28fe5e6d2934bb252139d9603433fb
SHA1 edb29a1ebf6e7a28f273c43e5a82d4a17e959140
SHA512 53b7a8bafbd793c00b6d2c095850ed6221c993a723c438b9679fe8ff1d650c7c593bb8f5e01ca6914085ff58679c0b6c776231faff4ce23e281e6d6886df16fa
SSDEEP 192:kUIU8U2UmlUmUnUiqUGUdU+U0UGvUccUEUBUbU6GUYUwUWU0UIUmUyU3UNUvUQTW:k333TD0SnAn37vinu8/G3H/bBttsAcMn
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 8KB
SHA256 0f6399e179432caf3173cae888d0316189e37238b8bff10f0aeb28409723809f
MD5 7364df9f202f4029cd196dfd64c43233
SHA1 49145c16bc55fc965f9798eda7c678780cb95326
SHA512 519379e866bed50ef01e5e6d177b0051ebde1ea76146210c60562d9c6c636e19717d2e6e8ab5f400d5b1d29c9f40c2960e8da2d0cd9d2f45dcc34217b5adea30
SSDEEP 192:+UuU8U2UmlUqUgoUiqUGUdU+U0UGvUccUEUfUlU6GUYUrUnU0U6UBU8UyU3UNUvo:+933TXvoSnAn37vin0u/G38ubzeLtsA9
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 b2d4cc9a2706807f56b23f4397582913e92286ae05de511c4b1064b6310df86e
MD5 85350d1a2764aa3229c5d206c43e628c
SHA1 e75b1094d8fbdf7a3136c5caea28e470af097de1
SHA512 873a80baeb55a91023a6b5e7aa2f36d1e151bb793ec51581ba19c36f1eb42824b35cac88df5ef6c0fe6d75021c9979b092cee7eb2b3e2f816de182da5348458d
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 8KB
SHA256 04a1a546070d27c799afb2d4b10ff12e6014bd8ff7c4a2696ecc66f0f0ad9ca8
MD5 c6282584062a452600aec489c030b357
SHA1 415b9754db397ada2a8136e991246a3950a36325
SHA512 6893734114734bb9a2d6571d132b32cd237a350960e8c129fff5affd737968e6aafd2cb714d1c63e48ce93a89d46e0e316d47e0b9bac6f3737b9ba09a1b5c84a
SSDEEP 192:+UuU8U2UmlUqUgoUiqUGUdU+U0UGvUccUEUfUlU6GUYUrUnU0U6UAUZUyU3UNUvs:+933TXvoSnAn37vin0u/G38ubzHOtsAJ
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity~RFe57a047.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a047.TMP
Size 538B
SHA256 cb5e9e6ae1c376e02af1049f20e280e0e41310e8942017c10c1fe742305dd397
MD5 7b65c9fdeb499bbe4ac24ca34a08e51c
SHA1 257b5724f92ffbaef2249459b02c77f91a59bd99
SHA512 07c6beeffa0b2e802962c2ed92cd01820a01e690c0fca589fd3193e788d1fd742ed94afdc02864f1b74f2f2cadc878722f37cc5228f03ba0bf20fe9c0bc7266f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 3eafd9a123a4bb3175f9336235013dab774d82893632676b3254fa900e5eeb77
MD5 34d4c83105f31c0e24534a91a980b91d
SHA1 0d2af332a2fbb0bbe49ff2cdc12da95837f873ae
SHA512 c58de0efae4e5e65bc1f1f2e3b7efd1f90b578e279081a34e150889d12d69e20e947b4b710261ee6f6e5eb5fb2fa3a8a4079a62ac33f7d0e202f07da3a68c6fa
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupzde2RU/dSXbsXzRznIYWL7:A9iIxuERzA83h09RZxYz5671zIDG8x
MD5 SHA1 SHA512 SSDEEP

Submit Download