0211d44d7ccb568125899c954bfc12a0396e9710a7cf24b4fdfa4a36b30343b2

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06/09/2024, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0211d44d7ccb568125899c954bfc12a0396e9710a7cf24b4fdfa4a36b30343b2.html
Size 124KB
Sample240906-nghrwstcml
SHA256 0211d44d7ccb568125899c954bfc12a0396e9710a7cf24b4fdfa4a36b30343b2
MD5 cf6d14cc1856c2277033d7c8ad36fd86
SHA1 d988d665bc68d563686cae3ffe4321a263611e62
SHA512 488c8841260da97768c9936d5751555ff55b4cf6231b8180cd7cb7759cf2fef829bcee17957b238ca0a7dccc20e15e712c20d160becf892ebd5c486eee38c7e6
SSDEEP 1536:xzvqopBkko6KGmo11VXldJsnH7DR4yGGJGCAdlD5YrIkmdsuU1og1QoaVteCe/em:xzvqopBkkpKRqHlEHcOmdsuV+iDiv5v
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
2072	msedge.exe
2072	msedge.exe
876	identity_helper.exe
876	identity_helper.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe
3920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe
2072	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2072 wrote to memory of 1608	2072	msedge.exe	83
PID 2072 wrote to memory of 1608	2072	msedge.exe	83
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1888	2072	msedge.exe	85
PID 2072 wrote to memory of 1488	2072	msedge.exe	86
PID 2072 wrote to memory of 1488	2072	msedge.exe	86
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87
PID 2072 wrote to memory of 1020	2072	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0211d44d7ccb568125899c954bfc12a0396e9710a7cf24b4fdfa4a36b30343b2.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9568446f8,0x7ff956844708,0x7ff956844718
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2584 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,15573489993014492305,12289525495094076898,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2744 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da
MD5 9b008261dda31857d68792b46af6dd6d
SHA1 e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3
SHA512 78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222
MD5 0446fcdd21b016db1f468971fb82a488
SHA1 726b91562bb75f80981f381e3c69d7d832c87c9d
SHA512 1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 95e23c9bd33bcd961c3b0f32a8d0bafed361388468293dc8c985ec0b0fcca99e
MD5 4ea8ec08076d210193c45e4e4c78ea12
SHA1 4faab79c39318de8bbb43e4a944f5a79bf9ac607
SHA512 04e244bbee2d4198f8bf2d9fc0688943b88480bea31b8856322d0dfcb29136025b5cd38b43babe1ba4989ed86ad3e7c588d40b06f5f4877dc4738ccc1d050811
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 120B
SHA256 e9c7cb619f3a25188bab6fb563ba4a004525d78f41c1a41f981e0bf93c4ba405
MD5 09d539821d3515ebe0a914d174718e6f
SHA1 808bdd1ba04dd73dd201b5ddfe06c13c0709d75d
SHA512 6f0227956fa706dbf9fc06b5b4cad2c8934f933a91d96987f781ec852da2030364f0c639704c83ab938e1766b6e22843c13951261a73ff22625e17c7fa4543aa
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 41a76178512e51eedda03d8eb38d68faa298e77019aa0af0c2197203129f92ba
MD5 37812781a142dd756d953da94fd2eb99
SHA1 48e773296cd190830b318497f9b2e500bf583dc3
SHA512 6891a959088b98e12657fc2bd021160420542b2d7d3c520eab8ad1f363a52695218729c77df4239a9bca5dee647e3ae92d21fc967e5d36ed5116fdc395e2d681
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 d6c5afd73a9f9638ce1c8c6dfe06800231b7edb068215df83389010b573fc1c0
MD5 6bfa654f1bc6c5884dd178200a33b299
SHA1 00a16e53094aaf4416f488d29f17b24602cf2827
SHA512 58f9edb3b3fcc9c1594723453f29e558a1505e7571b31dac20902913399adfc91c71a956b09ff780165f53a51a57c8b9ebe3e2c55c093d4a2f7178b69ce52ab1
SSDEEP 96:nck/Xb1i4dwpvWMoiVmdeH/ddYUWQyV+VDCziEwb:nck/rkeGWMX1Kro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 8c0794bc496bc8b3d98409216edac652e20143943492400e36d7cb6e1cf33cde
MD5 d3e961ee7b8ff275c7aa9887b96943d2
SHA1 716e7a8332d468f301a48f7c6d87728f887a568f
SHA512 4f7dc0905a1b34ee21907babe1ef8ef6eefdf13e266c4db6c58cea20992490f88efb96cdbc62c193dcea07e9113bbafbe38fc54d43652aa3252f07c40cbaeec8
SSDEEP 96:nck/bb1igdwpvWMoiVmdeINEKIVpGKVlb2/ddYUWQyV+VD7AiEwb:nck/HkWGWM4NEKIrGKVlb21Krg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 4deabc78e6e054de7d8328afb5e8f0956c8eb104076d88ecb0eea2829c781915
MD5 201ed39d065c3edcb2606ee867279fbb
SHA1 4669d3b5c86111b2f80f35ed2f69456d7217d0e1
SHA512 34707ea2fa5b9c885e73ee70c245bccbe83111026c90d28e7121c53644b7d05fc3a6282e8dfae681a8705c056956c53d6839a769bd5e8d357ca46ea1a1c5135e
SSDEEP 96:nck/Pb1igdwpvWMoiVmdeINEKIVpGKb2/ddYUWQyV+VDCAiEwb:nck/DkWGWM4NEKIrGKb21KrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 d124ade33ecffe296a858b3067b0f86904b45c6611bd743048a4e128776cf614
MD5 cf850fee93140f16c2fde94d3582e058
SHA1 5de2ddaa1f1c1e55fba67c41766fdfcd2d0ab153
SHA512 3cd7e450590f104a5310f59a5633bc45e3581908a88945721f5f5d441255f9295ff74fc796ab20b0aaf1ca6f1c5efec82a76396d4e4ebe9fbff4d24908b78eb9
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexuptTe2RUo23ICLQOl6feAOX:A9iIxuERzA83h09RZxYJ8YCS2
MD5 SHA1 SHA512 SSDEEP

Submit Download