hxxps://www[.]perfectmod[.]fun/incognito

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08/06/2024, 08:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.perfectmod.fun/incognito
Sample240608-kxtbsaaf2z

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2539840389-1261165778-1087677076-1000\{4F0DE753-FEE9-434B-86AF-946E61C7018F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
4672	msedge.exe
4672	msedge.exe
3532	identity_helper.exe
3532	identity_helper.exe
5720	msedge.exe
5720	msedge.exe
2272	msedge.exe
2272	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe
860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 22 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe
4672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 2176	4672	msedge.exe	80
PID 4672 wrote to memory of 2176	4672	msedge.exe	80
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 4936	4672	msedge.exe	81
PID 4672 wrote to memory of 3944	4672	msedge.exe	82
PID 4672 wrote to memory of 3944	4672	msedge.exe	82
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83
PID 4672 wrote to memory of 3160	4672	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.perfectmod.fun/incognito
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe32e546f8,0x7ffe32e54708,0x7ffe32e54718
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:5256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:5484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6552 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5684 /prefetch:1
  2⤵
  PID:5852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6664 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6500 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=33 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,17724288995186234859,10941244945144222171,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455
MD5 56641592f6e69f5f5fb06f2319384490
SHA1 6a86be42e2c6d26b7830ad9f4e2627995fd91069
SHA512 c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a
MD5 612a6c4247ef652299b376221c984213
SHA1 d306f3b16bde39708aa862aee372345feb559750
SHA512 34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973
MD5 SHA1 SHA512

Submit Download

f_00002d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002d
Size 512KB
SHA256 5f12968474e2995c485a2c256a9819dde04e78b6a13aacadfba935ed7970234a
MD5 ddcffefac58f205ea194e1612e7c22a7
SHA1 4db6276eccafc0030490f970824b55dc327bfebd
SHA512 4b8561f2bbc596382e9c22515354b94df9613844a2c6b6736dd7c1f6c51305e235c58160d8e5b3d6f5fa289dc55f6fd675332e4a13d07fd35282d61e227adc13
SSDEEP 6144:+senL1Ss3CpBXrFhtYNEeEp6mGjKU8tuXvQbObnLeA8WoxrKCz4syqm:niMUCrXtYDmggu/QbOrj8W4eEY
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000036

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036
Size 62KB
SHA256 eb48be34490ec9c4f9402b882166cd82cd317b51b2a49aae75cdf9ee035035eb
MD5 c3c0eb5e044497577bec91b5970f6d30
SHA1 d833f81cf21f68d43ba64a6c28892945adc317a6
SHA512 83d3545a4ed9eed2d25f98c4c9f100ae0ac5e4bc8828dccadee38553b7633bb63222132df8ec09d32eb37d960accb76e7aab5719fc08cc0a4ef07b053f30cf38
SSDEEP 1536:6+yyTwrwGtdPDZMlQcadLSHdqyjTxJMJwh09KWWXDManYPHc:6byTwrXL7ZoM28wPIawHc
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000037

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000037
Size 69KB
SHA256 0cda72f2d9b6f196897f58d5de1fe1b43424ce55701eac625e591a0fd4ce7486
MD5 aac57f6f587f163486628b8860aa3637
SHA1 b1b51e14672caae2361f0e2c54b72d1107cfce54
SHA512 0622796aab85764434e30cbe78b4e80e129443744dd13bc376f7a124ed04863c86bb1dcd5222bb1814f6599accbd45c9ee2b983da6c461b68670ae59141a6c1a
SSDEEP 1536:O76uwIZe9NVY6Nj/5StV8Zd3CcQWfeVmNk9nfNJxJIsAuB+U2:O7Dw2eLF5StKZgc5feYNk9TrB+l
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000038

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000038
Size 19KB
SHA256 381396157ed5e8021dd8e660142b35eb71a63aecd33062a1103ce9c709c7632c
MD5 76a3f1e9a452564e0f8dce6c0ee111e8
SHA1 11c3d925cbc1a52d53584fd8606f8f713aa59114
SHA512 a1156a907649d6f2c3f7256405d9d5c62a626b8d4cd717fa2f29d2fbe91092a2b3fdd0716f8f31e59708fe12274bc2dea6c9ae6a413ea290e70ddf921fe7f274
SSDEEP 384:OdEDMO3OT070pXDaeGj7ZDghRm9nyj4uIttWEDh2dvFBbUDfgAU:OiDM8OTE0pTal3Bg+9n2pItt7d2dLbgy
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_000039

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000039
Size 41KB
SHA256 f3e85184b9da403ef7277231046f43fcfe9d08f2bc21bf09967c43576d6a66ff
MD5 88680fb89f9210ec416b2da239b58b5b
SHA1 d0e7034c4ce7a100ebfba6f5ae73d2cfc5cf01db
SHA512 fb9e301ac1e7990a2f4c2f109e135c78a275d6feb07ad8aa7765ad3a5e8fd5c77085334ff1b3bab4222090bba6cf4b6b9b3a1e5da3bbf8958d64ed7143d31b39
SSDEEP 768:DEWJsMUL0XlDRM8K4AWL4mnh5kj/3T/zl1e8AmX2GSmE82c6/Twh1:48sMUL0VDRZuunTkj/3Dx1PAYRw0h1
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00003a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003a
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00003b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003b
Size 88KB
SHA256 b18b9eb934a5b3b81b16c66ec3ec8e8fecdb3d43550ce050eb2523aabc08b9cd
MD5 b38fbbd0b5c8e8b4452b33d6f85df7dc
SHA1 386ba241790252df01a6a028b3238de2f995a559
SHA512 546ca9fb302bf28e3a178e798dd6b80c91cba71d0467257b8ed42e4f845aa6ecb858f718aac1e0865b791d4ecf41f1239081847c75c6fb3e9afd242d3704ad16
SSDEEP 1536:WwVbiMNFmJrBrbhiWu0FKK9fLRXT+FjhwTn1sH5J3iotwUB4xzjIRB9h:zVOiFWwg3Rjm1wRW5JSywbo9h
MD5 SHA1 SHA512 SSDEEP

Submit Download

f_00003c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00003c
Size 1.2MB
SHA256 41b601617afa569c0a42d592341bdbc062b2480bc61f6ab89d85c43c1b2987ac
MD5 b48e876e91ec89fbaaef68677fac8058
SHA1 90d1ec84f062ed577f423c44dc8bf04bde44d514
SHA512 2d07f78ffdb9ed12e560c9ebf64fdccc4ddf89b7866d28f5c8ccb862ddd56977d2aed1e82158f6f7f444664b4417e96a7923994c51052acc8ca1d6739f7ab5d4
SSDEEP 24576:ArwK5o7bQsfjSP9ppy2jUIF+udAjBxN9Qbp0sjEb3YT903FCoF3D:Arzov/e3py2jUAdAVmbpIbWc9Fz
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 6776373f7b7bf6eaf6e0badea774d830989108aded842f6a3aaad5ec3ccbe25b
MD5 c6539dd6458d6884177bb7f0432545a0
SHA1 6224108a4d34ca8afc87c5e86c7f6bf135b5b9c2
SHA512 063b76e44f61d99d3ca29d89ceaaae5bf9cd816fbff45717ada5d99e283f3968a7f9053a2702c02bb61c341b4643e37db3addea2f6d9245c804ccafc921ea45b
SSDEEP 96:netf2BLxYlKcpEfm27T6iGk+ia2ZhgOWKYklkPVtVRTc008neZVpm1IWdU:ne2x8Ks+m2VGk+ia2ZhNWKYklkPVXRTw
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 731264d599361fa0fada8124c4121a29ff405324dfc57ee62873bb5b5a0665b8
MD5 d43ee105c78db86c8c257a956caf56e8
SHA1 a170e4c279f8162f129319ab98447c8a6e890e66
SHA512 5265041ecc1ca3f7d1e148a1bc376d0d01b6343cc9ac6161b531fafe1e7e49d49f945c4a07c428391db75d2977c52c54d28d353a5a826a0803304f97fd602f79
SSDEEP 96:5tBVeFAf16BZSFehwxcBx8m27W6iGk+ia2ZhtOWKYil7lPVtVRTc008neZVpm1Ik:jBVANZKeosam2AGk+ia2Zh8WKYilJPVz
MD5 SHA1 SHA512 SSDEEP

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 7KB
SHA256 0116e52836130af47f39f7364ad45c5cc51c33be0c16ea66e2f1fe4efd306aec
MD5 a44d7ea2b74b7bd6cbe4649bfb102eb4
SHA1 e56df00efb40c0170bc19d32cd79691d83b7565d
SHA512 b4fd25e2a029165cb4d00aa2de1e15c67bbfe6c578838ba9300a792f64cac4886a7447f34553a1eb6d66dc05dfd7bca609c9ec71e6c510ea1fe5ebfae05511b3
SSDEEP 192:XE6mq8uT6psm6w6lOf08RqihhXrJBhjjirNKF606fu68t6Qlj9IgMzVGW/yFiGHA:XE6mPuT6psm6w6lOf08RqihhXrJBhjjW
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 9b2d2d2773bb8535e60f4bf20dcc3b5afa421d9dd9ef53d4588f26309b03b5d8
MD5 2ec02c6b8f58a3e2a6cffdbd658a3603
SHA1 1705b733eb2b8dab4ae7c2d44f18ef875f773a03
SHA512 6d6d2576368b70eeee25c7b21e47f74586f5fb7e99894973f95bad23a647cfeac3b7bd1f5fb38577c79083ede279e03b5086dfbbe7c91b9697185ca1c5cd1a6f
SSDEEP 96:nIGkTY91J6v2wpvWMoiVmdeHk4dssUWQyV+VDCziEwb:nIGkk9Wv2GWMXDssro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 8KB
SHA256 260eddd57fed515d1a3efeaf3b760c8475e1ee9c91bbe3d20d1319c4a304296d
MD5 7066caa41a2024df6de10188f159bd78
SHA1 c91029e2e4e360c765208778eef1d647bab5bed8
SHA512 9247f7416de05f862f6fd40f729d080b53d4bffa1a00789aadc9b7c2584b44ffd1a1d49229124ddbf012715eedb34282735afde1d0b9c7a31206c9d0baada283
SSDEEP 192:nIGkI9Ou2GWMW7wBF7JCgN8p4i590NwktOxCOEVCjU5nbRZmku82OUssrg:nXJOuHWWDwHeVN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a26f9f39cad3e130c7f244b8636fd4640b3e3994ce618eb3eb3935f8f3a6a384
MD5 286ada5edcc4fb701ba0d47dae35abc7
SHA1 9996f59fc3cd6d539896989905c13baa0390f32b
SHA512 eb66efa0c62e6c0f47d2f3a6d9cf11f22172b016d9eba344807ac2531b5d7ce22f7b7c84ce7ac20eeb0d147e8b2c27795aac3f8390b832fb8398f91f6e826394
SSDEEP 192:nIGk+A9Ox2ST5WM5VGeOaQIqxdybo7wBF7JCg0iN+aHp4iYM58it90NwYCOktOxw:nXiOxHW2rD18VPe0GVZ
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c713b7a00a9a260b7ea300f608d9d3e67e3071e991eab388c91e462c0f55c054
MD5 bcfa61fb17820d701d90608b52eba5a7
SHA1 1fd6fdadf8b2f549ee4d465724e5acb8c69fb86a
SHA512 992281c90d0c6895d32c0317cbae0b8f45160b8dc673a9146bddd2e338d999c6225f30cd9f66153c7d7f2a41770ef376dff45b47c2a7a587dad196a1d6dd9f2f
SSDEEP 192:nIGk+E9Ow2STadKWM5VGeOaQIq/zu5ddybo7wBF7JCg0iN+aHp4iYM58it90NwYK:nXOOw9WESrD18VPe0GVL
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 7a6629836deedf454619bab323541a0909c1935f8110d60bbd261dad181f1e69
MD5 149fa14b9cbf0c7eb1ed306f6f104246
SHA1 b746b6b881efce0baa913bca0448bcde4f8e3861
SHA512 8aaed4596a1df02f74c931781f968a9e1ced75b13c5e14c7b7c055380a4c4202b221a57253c3a06376ff3a0e406c8a4f2743008e33080c7455f072cd32369a37
SSDEEP 96:nIGkBY91J6/2wpvWMoiVmdeGkuo1jkb7dssUWQyV+VD7AiEwb:nIGku9W/2GWMWkuohOJssrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 4df68c1eaa40af217a629873be8abe614aecb345cb9f274e856923f825151cd4
MD5 79a8e04d66eecfeebb9827bc29f5dcec
SHA1 fca013caf1da7dcb23b7e35b677d3b7a839fdc05
SHA512 07b1d02ee6c32832672c9734e973acf26bf5178fd5865822568adda5fe197e745ffebe5459bee8c2d9905feef30ab96967e1b7b27afe0b9f5e7e688a67b4398e
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 fa8de50bb46cabccb4464a68280f9f643513d2f749d588f17ad47249a6852475
MD5 c003a35c0f67652cde6b38e0946e22f2
SHA1 458de3406523a8c7d027ecc4e85e0e55ace033b7
SHA512 d2d393ba81e232eeee04c3efd20c0105f2844628014d83c20896ea4cdac5054effce59e67e5f741c5ee48d6904984d3e6bbf9d81c2458e24cf7c83165f1e2838
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 2KB
SHA256 d3ac547b7da8a68e562c24c1537312bf0602fbbe1a8e01ebf1eb6fdd7057a643
MD5 6ab195f3a145ce63a9af8f815b5c096e
SHA1 dbd84f2855a3ee83646b49ed35eeeb54eae6f2d6
SHA512 4fe553f9fe659b943975dcf61d73dd784e97f6485dd0a2d7499abe7af5fcc07a52855ca95ff21e34e5c10aa3fef522637ea8ee2d9016528d65a0799368094863
MD5 SHA1 SHA512

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 871B
SHA256 cb91dce71b1eecc988dbe0e2697ff083c4d0567e359079d84d6e2dc39b77a232
MD5 2cbb1f3a8577d4b37fc7cbc599d59609
SHA1 911773e741a51dfbb1be84eea25d37a3f07af65e
SHA512 4e6d97d3646c33eada82ab8fa78b0746969ed81bd2b3946e0bc3220fe1cf19da3422ba48bce24346513db1dc523d17a4328a25f1ab2fa6256ca0c091e3ee8e05
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57a3c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57a3c2.TMP
Size 202B
SHA256 223af17438d2cbb47e800f035777e4aca553a2803145ce704fba606d47cfd946
MD5 ac076aed4ff6031b5b3e8bba0e5dc087
SHA1 fc7226d2e497a7d7691ebb97363480498d1fb900
SHA512 be4ea0f6d38a23892154d3b47581384675f0781d34ab583b2a92e22235594ffc64aba2832707715616a0d21662fa8d2a8d408063daf608aeefe9f49a7f02adfe
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1f09f95ee409cee9d30bf0e37ff58e6e8b554ae46b32638f9eefecf2a0c31fcb
MD5 b0f9c40d6b4d3b83b506915cd74d4344
SHA1 59a50d41f6623ff4d5cf61f512d5508dea493e20
SHA512 537555a7de91d0ca56d8a848e35c08830db70283cc095cc5b010603283549379220998ac6cc7d41d047234560864834c8bdae21a96f24b175e85edccc9b4730d
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8xMOe2RUu+ny4VpzT3z2Ot:A9iIxuERzA83h09RZxYmUtaOMWRHqlW5
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fca7e408340fd53c1a0409c239063ea4dc595480b11dc687df4e297cdfab30fc
MD5 aa7f8d145b2327e2e9fada02cbb41427
SHA1 fecbf6e652c2e7d107069a90c3b5fbe379e1bf3b
SHA512 ac0530d5cd40cefbd73d5b2ea20f7baad090925cc2279ac8fefb0bad883e523a932a3188784441aabc7255c336c9dc3c46c6cab1b6704efa007643ab85966233
SSDEEP 192:ToCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8/5MOe2RUu+XSP4Vpzc3zZ:z9iIxuERzA83h09RZxYwxcJSaOMWRHqc
MD5 SHA1 SHA512 SSDEEP

Submit Download