c409415a7ee1ecaa02cbe355288611cd897d7fad794554645468274035fea18c

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
27/08/2024, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c409415a7ee1ecaa02cbe355288611cd897d7fad794554645468274035fea18c.html
Size 40KB
Sample240827-seh24ayalm
SHA256 c409415a7ee1ecaa02cbe355288611cd897d7fad794554645468274035fea18c
MD5 c53569739dc61facd0c5e70b741c8701
SHA1 4856ce7d2cc4278f3f3ec14e9c74cef97f79ca90
SHA512 63133a9955f526f3edd1690f2ca89182fe615776d5c90ba1ab394cc95454e43f9741d75a07de57a791ef37b167ae902a246d2f010ba37576042ccbbeb4bdb5a6
SSDEEP 768:ekcluTMocmLj+aP0pSqzMuy/4rpd6nElWzC2SKN:ekclJgZP00EaKWzr
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
640	msedge.exe
640	msedge.exe
1728	identity_helper.exe
1728	identity_helper.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe
3640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 2484	640	msedge.exe	86
PID 640 wrote to memory of 2484	640	msedge.exe	86
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 4992	640	msedge.exe	87
PID 640 wrote to memory of 452	640	msedge.exe	88
PID 640 wrote to memory of 452	640	msedge.exe	88
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89
PID 640 wrote to memory of 224	640	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c409415a7ee1ecaa02cbe355288611cd897d7fad794554645468274035fea18c.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b2d46f8,0x7ff82b2d4708,0x7ff82b2d4718
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3064 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1120 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,8074064310814929541,13358740971546623921,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4228 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2040

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff
MD5 ab8ce148cb7d44f709fb1c460d03e1b0
SHA1 44d15744015155f3e74580c93317e12d2cc0f859
SHA512 f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b
MD5 38f59a47b777f2fc52088e96ffb2baaf
SHA1 267224482588b41a96d813f6d9e9d924867062db
SHA512 4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 505B
SHA256 ddea218b86fc451e6f392c8366d433c1d6a922117fe6c508facbe43da0f38e11
MD5 c55681845c5a141c185f9b227427255f
SHA1 c95604a8be105c45c3aef33787a6f39f76fe8f99
SHA512 30d7c2a1929b1aaf4c5b94de03fc6e526e23987e39d5330638ec00a17081ee77cebc849c9f59cd0cfd0747d5f7a78660830724f5e826cf3c55b054fb7fdbeecf
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 3e3c658350af30896419afc507316ba31a57331d3b49196863a5c96147dea696
MD5 825acb40dbd796f80e0a79d1ed2a8601
SHA1 594d9419d35fee19bfb0e83cc978d0ee7edb9150
SHA512 b1282baca929b8c24f9511613feb78fb672cf6086e5f0fc878c5c29cbcf0341df1d45ffea685bef4c26ba62b79cac8a03ffd0e78369e4988ad289a25bdb83612
SSDEEP 96:n2kzFO1ZRwpvWMoiVmdeHm9aUWQyV+VDCziEwb:n2kz4PRGWMXxro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bae8e8a02327718919ee85606aa8223ed61b5696dbf45a82169b666e29d128d7
MD5 416d3c080d808a740536bb2a7077c5b0
SHA1 448d093356c39999377cd99eb917417e06569f48
SHA512 de1a66c20439721f57ebf79712f524cda0a4a3c9fad1ba205cefe24d2294280c9b2755ad1c2ce78331fe0b5fe27c1a5dcb26b921687fab85682b60e2e951e01a
SSDEEP 96:n2kzgO1JRwpvWMoiVmdebz2m9aUWQyV+VD7AiEwb:n2kznjRGWMLz2xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 30d9e760a5f11364519fc8e98c51b0f80f1ae33d4a7a42dc9ef41b5597c56b16
MD5 afa2e4c2a0f5069fd14c54edb16a129d
SHA1 b2a0cf18974056ce72b64adcdde8f3be2c2e05ec
SHA512 5964e905ce963ecca8a1dc3b0c8a9b58662804add1c82bb9c138ae1cb35948d4b944b73215a1abd63eb7a18787ae7111b3d4610bb546b5e2ea8360f11b8a21a7
SSDEEP 96:n2kzgO1ZRwpvWMoiVmdebz2m9aUWQyV+VD7AiEwb:n2kznPRGWMLz2xrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 26bb42bf8844ce96f8185b795ea058d1d1ba330b87918273275a6436b906217d
MD5 95986dfaa906f5ae2e317d0e996a8f64
SHA1 acf18c59e2c52f4f396aa7587f9b2b9186c17dc3
SHA512 fa784a3c69d1c8f7d749c26062778b0dfbbfee061ad4f5f4176e2f09721a664e1dac258b12a1025cb8b72b699cc9b4e0e69d5bc2311816455a1443e6f7a434bc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupoe2RUm/lYOkRw5Ytj9Zkly:A9iIxuERzA83h09RZxYGzVfkLsEXR
MD5 SHA1 SHA512 SSDEEP

Submit Download