4af1b3a27e898e055d036e00fdeba3133b71d4296307c99352cc1c05ef8e2213

Analysis

max time kernel
138s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14/06/2024, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4af1b3a27e898e055d036e00fdeba3133b71d4296307c99352cc1c05ef8e2213.exe
Size 7.1MB
Sample240614-bmc3datakl
SHA256 4af1b3a27e898e055d036e00fdeba3133b71d4296307c99352cc1c05ef8e2213
MD5 ee6cbde6a38e54f9ab3479321150d3f7
SHA1 8d33ab6b86cda56d006e2badbed405fe71a0c923
SHA512 1330be9d0fc1f067b0f15bd8bc1fe3fe5bd10a34965f61e8f63f0e093f6038fafdd1fe173db9542598f3e2cdc85099a83efc046580d95522f4d3cd7dac9e67d7
SSDEEP 96:bMNNaksH7xuKjG8k5kWoVWJx6U2A9orC3f89S0UYgfMMMSuVZ1nzOKRbDuG9Ru9Z:CNapbiWHVwr2r9SPKVOenpf01
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
3016	msedge.exe
3016	msedge.exe
3252	identity_helper.exe
3252	identity_helper.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe
4668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe
3016	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 3016	316	4af1b3a27e898e055d036e00fdeba3133b71d4296307c99352cc1c05ef8e2213.exe	87
PID 316 wrote to memory of 3016	316	4af1b3a27e898e055d036e00fdeba3133b71d4296307c99352cc1c05ef8e2213.exe	87
PID 3016 wrote to memory of 768	3016	msedge.exe	88
PID 3016 wrote to memory of 768	3016	msedge.exe	88
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4692	3016	msedge.exe	89
PID 3016 wrote to memory of 4844	3016	msedge.exe	90
PID 3016 wrote to memory of 4844	3016	msedge.exe	90
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91
PID 3016 wrote to memory of 4412	3016	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\4af1b3a27e898e055d036e00fdeba3133b71d4296307c99352cc1c05ef8e2213.exe
"C:\Users\Admin\AppData\Local\Temp\4af1b3a27e898e055d036e00fdeba3133b71d4296307c99352cc1c05ef8e2213.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t.me/Private_Hacking_Cracking_Tools
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3016
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcf6b46f8,0x7ffbcf6b4708,0x7ffbcf6b4718
    3⤵
    PID:768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
    3⤵
    PID:4692
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4844
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2732 /prefetch:8
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
    3⤵
    PID:1108
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
    3⤵
    PID:3988
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
    3⤵
    PID:2220
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
    3⤵
    PID:2260
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3692 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3252
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
    3⤵
    PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
    3⤵
    PID:2296
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4548 /prefetch:1
    3⤵
    PID:3676
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
    3⤵
    PID:556
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,18007759291903161101,9678214675139603992,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3900 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2756

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 e6bbd4933b9baa1df4bb633319174de07db176ec215e71c8568d27c5c577184d
MD5 477462b6ad8eaaf8d38f5e3a4daf17b0
SHA1 86174e670c44767c08a39cc2a53c09c318326201
SHA512 a0acc2ef7fd0fcf413572eeb94d1e38aa6a682195cc03d6eaaaa0bc9e5f4b2c0033da0b835f4617aebc52069d0a10b52fc31ed53c2fe7943a480b55b7481dd4e
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 2ebd5229b9dc642afba36a27c7ac12d90196b1c50985c37e94f4c17474e15411
MD5 b704c9ca0493bd4548ac9c69dc4a4f27
SHA1 a3e5e54e630dabe55ca18a798d9f5681e0620ba7
SHA512 69c8116fb542b344a8c55e2658078bd3e0d3564b1e4c889b072dbc99d2b070dacbc4394dedbc22a4968a8cf9448e71f69ec71ded018c1bacc0e195b3b3072d32
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 72B
SHA256 a2538d8268f4484f65f9012e5b01303b11aef1f90b032736b5eb36d1e2657076
MD5 c5509126e3bcee57c856d8d6b489080d
SHA1 9a00181fc4a2cf19c7fb346f30ce2595d0897332
SHA512 d06d5b4d10720767cb9083fba3d2891da333b5b19e1bd5d0050f11097877257cfcbe8550c83b45bd0fc184d50678abe8b512fb7989be1b08daef35573cfac7bf
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 442B
SHA256 32f095e913f677a49886c22b8c1d0d22c30c660a0c716be844049db447f43ad9
MD5 3def184f1b0c18654055c308946b0fe7
SHA1 46a55a3f5ab7d0b54ab0e79411fb679f56ab6f74
SHA512 a6f83d10863a0599591af575b0089e44d22a131b0a61b5dc34a3f7d129af5b7a561be7cf4e054a51bbe5cd55b6d87fb117d884f28411c17bbb887e3dc74597f7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 417fd6abd189606cfefd3e1a5e10922e678900044fcf7380ec56bf486de3d3ba
MD5 e2af9260d78c609b184ee009887e24b2
SHA1 94afa3ec9be80b205fdcfeefa74bb264e0f1a063
SHA512 28df2d3abb6c15c2e2cd30662c70898820b77d38bcfc8336d2be1c4a5d183892ef0bd44cb48b47c08387e1af970c9054cd24156ffcbce44f8c34661f75f3995c
SSDEEP 96:n/kVoxm/Dnmqx10jwpvWMoiVmdeHuj1j2WlcSUWQyV+VD7AiEwb:n/kf6eijGWM3ujheSrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 90184ee74e23a4933c9f1e9b70b20ee77a4a580304aa551720937bd61abb27a6
MD5 19f613940eebe82c98c0ee7574ebefc8
SHA1 7fd18f20ea0fff03cee7ec1ccf3d055e0f09c0cc
SHA512 e8308cb8109c06d3f08c284da562b88916a906dec8aa25b217a1f1bc95951aa9569ef46684ade08110bce30f6fa62a509c140d0fd9475115a30582f40ac80922
SSDEEP 96:n/kVoxm/DQYmqx10jwpvWMoiVmdeH2WfcSUWQyV+VDCziEwb:n/kfIeijGWMXMSro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 2846089216b19853f503e07277cec45f1902bce15b20ba40b8dabb184c4db20d
MD5 5f14c79272e53ad32912eb9acf18e738
SHA1 6e14db47d0553de421dbcc3b48a35bb989047ca2
SHA512 7605639a469f3c41be4ce3f76a1ca9f0e9633bea968a46546e13fee61779747ded4fdd9749a194b7d621988bb20f36e8c3b2e9c53f7c48ea43962381c4ef9116
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupXvHfye2RUxJh/23z2OMDCm:A9iIxuERzA83h09RZxYX/Ek2aOMWRHq3
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/316-0-0x000000007485E000-0x000000007485F000-memory.dmp

Download

memory/316-3-0x0000000005550000-0x00000000055E2000-memory.dmp

Download

memory/316-2-0x0000000005BE0000-0x0000000006184000-memory.dmp

Download

memory/316-1-0x0000000000B60000-0x0000000000B6C000-memory.dmp

Download