6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe
Size 5.9MB
Sample240902-bga1tsyajd
SHA256 6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1
MD5 8a106702940869dcbaafa61e9335de95
SHA1 895f7262a40a8bc01c938346f263b02359aa31be
SHA512 33b583e972e44d8f7490b9f11cdedcb8090d5404226228a935703631644975e229e9acdabc22ac92a6d9c5dfdfab55fa5b5697d3b66549529615ccee4dd0b109
SSDEEP 98304:bBThjeo8DyBFmDBWps6aG7Ds2txx/2NYZF+0EtpbcazgMNetGKNzKMf47n:bpJh8uBAas6aGFGYmAazh0tjGMf4b
MD5 SHA1 SHA512 SSDEEP

Score

9^/10

discovery evasion themida trojan

Malware Config

Signatures

Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs

evasion

Query Registry

T1012

Virtualization/Sandbox Evasion

T1497

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__	6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe

Themida packer 6 IoCs

Detects Themida, an advanced Windows software protection system.

themida

resource	yara_rule
behavioral2/memory/1956-0-0x0000000140000000-0x0000000140F72000-memory.dmp	themida
behavioral2/memory/1956-1-0x0000000140000000-0x0000000140F72000-memory.dmp	themida
behavioral2/memory/1956-2-0x0000000140000000-0x0000000140F72000-memory.dmp	themida
behavioral2/memory/1956-3-0x0000000140000000-0x0000000140F72000-memory.dmp	themida
behavioral2/memory/1956-4-0x0000000140000000-0x0000000140F72000-memory.dmp	themida
behavioral2/memory/1956-6-0x0000000140000000-0x0000000140F72000-memory.dmp	themida

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
1956	6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4068	msedge.exe
4068	msedge.exe
4436	msedge.exe
4436	msedge.exe
2948	identity_helper.exe
2948	identity_helper.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe
652	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe
4436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1956 wrote to memory of 4436	1956	6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe	87
PID 1956 wrote to memory of 4436	1956	6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe	87
PID 4436 wrote to memory of 2612	4436	msedge.exe	88
PID 4436 wrote to memory of 2612	4436	msedge.exe	88
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 1044	4436	msedge.exe	89
PID 4436 wrote to memory of 4068	4436	msedge.exe	90
PID 4436 wrote to memory of 4068	4436	msedge.exe	90
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91
PID 4436 wrote to memory of 4748	4436	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe
"C:\Users\Admin\AppData\Local\Temp\6a8e71bfa831c024bb7b5c7565bc5144ba42d298f8d92dcf48e995e0911669d1.exe"
1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://dash.usehorizon.net/auth/1b74ca46-c49b-4c52-a57d-8cd1ff70c625
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9912246f8,0x7ff991224708,0x7ff991224718
    3⤵
    PID:2612
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
    3⤵
    PID:1044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
    3⤵
    PID:4748
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
    3⤵
    PID:1780
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    PID:2120
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2948
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
    3⤵
    PID:4680
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
    3⤵
    PID:4784
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
    3⤵
    PID:4308
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,6594676371203179089,6306257430865252309,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4940 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:652

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808
MD5 719923124ee00fb57378e0ebcbe894f7
SHA1 cc356a7d27b8b27dc33f21bd4990f286ee13a9f9
SHA512 a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e
MD5 d7114a6cd851f9bf56cf771c37d664a2
SHA1 769c5d04fd83e583f15ab1ef659de8f883ecab8a
SHA512 33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 864d40caad769c494b6f205efa5bc0250b236d110d8be26a43856f8c7d0303da
MD5 d9659f94ca3d892e8bc11e6d874f6867
SHA1 b1ac965d624885cc98dfe449bb1dcb81c27fa5ed
SHA512 e2a349425ac692bf09a66032e4ed4df7b2847068bd938d0d7e349c4edb6ae0f3cf087f392e0889e024f4df3cf079f11145d5a8482e227e5028558beeaee48794
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 948B
SHA256 dfe0ab001b200d8c62866f7882f07b658afbd5cd8130fe034f84b2f5661738b8
MD5 48ec657f1a83945a8cc489a21bda0401
SHA1 810245bedd14390bc0361a569366ae179f9a0e3b
SHA512 8741a2246ece74076f24b4c2ede463418151f8a5a2e3b568b31dd716165c96fd08f92ab67841978dd2308d3d286596220c89759cf348b3a2a6a03047830183dd
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 6aefe687d1d62532fcf187c03cb7044bfbef0d0265d544e585e08f5368721012
MD5 d6dbd90ba7418964b1933eea59eff59d
SHA1 a0231abd02fbcba88d5f1b73c83f7175f02d3e45
SHA512 64ce93db755a845a0aa387ce11fb2ffb87492d0b6019d0a0c764d7d92650e4b9a50df45f02b9c86bf838824921c34d7dded422978dafd9f3518c33bfba503a14
SSDEEP 96:nTkxaV15wILSFhPwpvWMoiVmdeH/bXtUWQyV+VDCziEwb:nTkxikJFhPGWMXztro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 1386fc00393f60cd4cef660997dc502ca92b518f9a7240241d7860eca846c531
MD5 f179862915057f2d9a37edb041d33898
SHA1 3b3e7946d7a4408515df9573e7bf9705ee8e4405
SHA512 6baa250144d46f84c9162de52be4e3f93cca1133b963eedae65f51859db15dcd71d5a0b1747f693bf10c2eb2a0948f252a52a0b6195d6338d437bb4ba65244e2
SSDEEP 96:nTkxkV15wILSFhPwpvWMoiVmderuI1j/SXtUWQyV+VD7AiEwb:nTkxYkJFhPGWMbuIh4trg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 12806d3c105d1396cdc16c9e9d8342d69c17c5fe33b5972db490a6e68286cc13
MD5 be2770e318008f8c7d9b9d6fd815f712
SHA1 61319baefa161336296c27f3e51cdc57148b289b
SHA512 46cf908747c3db31e030419b9e2f018492e7b542c04879e050068c3c54e13376139aa801c2ce9d3beb6010863fba828df145ad7b3a5d97d8344e61003bd74a67
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup5te2RUc/xNNRw5Ytj9ZklG:A9iIxuERzA83h09RZxY5pzzOkLs6E7A
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1956-6-0x0000000140000000-0x0000000140F72000-memory.dmp

Download

memory/1956-5-0x00007FF9AED90000-0x00007FF9AED92000-memory.dmp

Download

memory/1956-4-0x0000000140000000-0x0000000140F72000-memory.dmp

Download

memory/1956-0-0x0000000140000000-0x0000000140F72000-memory.dmp

Download

memory/1956-3-0x0000000140000000-0x0000000140F72000-memory.dmp

Download

memory/1956-2-0x0000000140000000-0x0000000140F72000-memory.dmp

Download

memory/1956-1-0x0000000140000000-0x0000000140F72000-memory.dmp

Download