92533be6c7fdd0cb591fa4a9d760b49f441703545404f5ce780403092056341f

Analysis

max time kernel
151s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2023, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0cadf56216e663ff2a8f3882ed0fb681.pdf
Size 15KB
Sample231012-mw431aea8v
SHA256 92533be6c7fdd0cb591fa4a9d760b49f441703545404f5ce780403092056341f
MD5 0cadf56216e663ff2a8f3882ed0fb681
SHA1 1cc259aa315090a50237144dc0926be0abea4190
SHA512 66310df255c6e35cf1d1ae9142f5467db58b9598ceff066f5c7d78e24bf377434382ef9f656ba786885906d40196ce78e443fd4ffc0ddd9ea375cef34602a1a7
SSDEEP 384:/8fVsuD4nuVC2GGGGzoTLb1zM7cfZsOvcAQdu3nh:/8GKC2GGGGz8b1zEcjvcRk3nh
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	AcroRd32.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	AcroRd32.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4232	msedge.exe
4232	msedge.exe
3892	msedge.exe
3892	msedge.exe
4024	identity_helper.exe
4024	identity_helper.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe
2664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe
3892	msedge.exe

Suspicious use of SetWindowsHookEx 7 IoCs

pid	Process
2768	AcroRd32.exe
2768	AcroRd32.exe
2768	AcroRd32.exe
2768	AcroRd32.exe
2768	AcroRd32.exe
2768	AcroRd32.exe
2768	AcroRd32.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 3892	2768	AcroRd32.exe	88
PID 2768 wrote to memory of 3892	2768	AcroRd32.exe	88
PID 3892 wrote to memory of 4120	3892	msedge.exe	89
PID 3892 wrote to memory of 4120	3892	msedge.exe	89
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 3164	3892	msedge.exe	90
PID 3892 wrote to memory of 4232	3892	msedge.exe	91
PID 3892 wrote to memory of 4232	3892	msedge.exe	91
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92
PID 3892 wrote to memory of 2636	3892	msedge.exe	92

C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe
"C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroRd32.exe" "C:\Users\Admin\AppData\Local\Temp\0cadf56216e663ff2a8f3882ed0fb681.pdf"
1⤵
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://booking-comdetails.blogspot.com/
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3892
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc91ac46f8,0x7ffc91ac4708,0x7ffc91ac4718
    3⤵
    PID:4120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
    3⤵
    PID:3164
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4232
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
    3⤵
    PID:2636
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
    3⤵
    PID:416
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
    3⤵
    PID:1176
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    PID:2012
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5064 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
    3⤵
    PID:1100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
    3⤵
    PID:64
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
    3⤵
    PID:4732
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
    3⤵
    PID:2468
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,8676244395922306069,12686787051095574699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5512 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3920

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cee74fad9d775323a5843d9e55c770314e8b58ec08653c7b2ce8e8049df42bb5
MD5 4d25fc6e43a16159ebfd161f28e16ef7
SHA1 49941a4bc3ed1ef90c7bcf1a8f0731c6a68facb4
SHA512 ea598fb8bfe15c777daeb025da98674fe8652f7341e5d150d188c46744fce11c4d20d1686d185039c5025c9a4252d1585686b1c3a4df4252e69675aaf37edfc1
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 aa0f5715b15ef7d6b99b418e4ba5ec59043101157c63bb8712ea11c69b344320
MD5 d1ed5aa7c54cc8be0c823e092ab6d085
SHA1 e24ba0918c405c47a0f6f23c3d44cde40c478a03
SHA512 feb6b79b3d3375e21897aa39f7338e87aa4e4e5b6da2abfa80cd28fbbc1aa1f1ae4135642a0186f8f042ded4e6393faeb238479b839a14875448ee1451955083
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 a41c92f401ff3062c618cf2b1386374885ca2c12d78e4750465055715196d011
MD5 a804e9823cef99d743e44cbe47f7bfe9
SHA1 fbe993d0939c5cf0679fef6c2d5ae5109d5a3a76
SHA512 0c68fdd473bfa981d72f17cb34953ccde1181ba36e7081172674388cb2c6cb103fd69ceda18b5bad1caddb3f229d79f0d1f992d4b0d3bc1ef91a8cce1f92976e
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a0e221a392a01f8f2d92c7e0b30043e25b06cc58115fb7f7cc9bc8a58a416ee5
MD5 84dc35a7cff57d0694a284aa909c3168
SHA1 14fcdfa9b61cc85a73cd6dbbec64e08d66514957
SHA512 1561045b7f5eef6f61232b56acdd435d6837cad8f5ff983e75882e196ced082dda0269cf7955045fd5c21f12ffad812d83ea75263d7bd970218c0ecc978626f8
SSDEEP 96:nqkGlG10QMwpvWMoiVmdeHd4oUWQyV+VDCzia:nqkgGGQMGWMXuorj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 044cac379dddf0c21b8e7ee4079d21c67e28795d14e678dbf3e35900f25a1e2e
MD5 d555d038867542dfb2fb0575a0d3174e
SHA1 1a5868d6df0b5de26cf3fc7310b628ce0a3726f0
SHA512 d8220966fe6c3ae4499bc95ab3aead087a3dd915853320648849d2fc123a4acd157b7dba64af0108802522575a822651ecc005523c731423d9131ee679c2712f
SSDEEP 768:n/4W7T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNLlYIrUQs4F:n/4W7Tu1jaQLqQsm
MD5 SHA1 SHA512 SSDEEP

Submit Download

aff927d9-f693-417e-bb44-70117b33ac87.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aff927d9-f693-417e-bb44-70117b33ac87.tmp
Size 6KB
SHA256 0e30a38338ca46d586c61348ea9b87cbf9c9d373c29acc9b9dcb150c4bc25983
MD5 29fca010074740b23d7a5ed93e0223ec
SHA1 667bb1fec46f515e0bb2d5625bf89756bcdc35c0
SHA512 48ae087025e543daa46a039a2dab4df403847fb392270d96367dfb74874f8ac1bf06d40336821f50de567701b49c4f12163205862f6397e34f0b4b6d3662f15c
SSDEEP 96:nckYlG10BMwpvWMoiVmde76uUp1Y4K8Ggp+2d91LoUWQyV+VD7AiEwb:nck+GGBMGWMr6uUpGFup+2vhorg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0d8faf368f153a2eb158b44aeb81d8ff24d337a9d496959e2fd5f777bc4b6cdb
MD5 f600ca6ebe7fd18f7f7dd02858d59bc0
SHA1 e92ae15b9a797c025d004adccf37341b2ca8a38a
SHA512 612fc4b9b195dcae7b4d3b6cbe2d3a4928a4a2260cc50a794c136e9da102257df7cb9a310d5d9fc90c1c1147f3f8c75e3c9e65af3d724016b02e2df8392ec7b8
SSDEEP 192:6oCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexups559e2RUj2blL4Oynf3yfv:+9iIxuERzA83h09RZxYo5ZhL4Oynfyfv
MD5 SHA1 SHA512 SSDEEP

Submit Download