hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001ta38JYWYcKTTeblftvgzKAd7MLs3U5aQoN-UJNPCIW6trFFnVp4hcO364Qp5Xf10x_MiHSwpjpnywLH700NIJD3APHF22hVcA0BX2cWvF1mJ7B0ooBwPeuM8rzDFkSCwI5vLuTLCt-I=&c=&ch=&__=[//]css/content/newfile[//]064/fhi/YWxhbi53aWxzb25AbWVsYm91cm5lLnZpYy5nb3YuYXU=

Analysis

max time kernel
48s
max time network
39s
platform
windows10-2004_x64
resource
win10v2004-20231127-en
resource tags

arch:x64arch:x86image:win10v2004-20231127-enlocale:en-usos:windows10-2004-x64system
submitted
13/12/2023, 23:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://r20.rs6.net/tn.jsp?f=001ta38JYWYcKTTeblftvgzKAd7MLs3U5aQoN-UJNPCIW6trFFnVp4hcO364Qp5Xf10x_MiHSwpjpnywLH700NIJD3APHF22hVcA0BX2cWvF1mJ7B0ooBwPeuM8rzDFkSCwI5vLuTLCt-I=&c=&ch=&__=//css/content/newfile//064/fhi/YWxhbi53aWxzb25AbWVsYm91cm5lLnZpYy5nb3YuYXU=
Sample231213-3vmekabff6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
3392	msedge.exe
3392	msedge.exe
3020	msedge.exe
3020	msedge.exe
5048	identity_helper.exe
5048	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe
3020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 4856	3020	msedge.exe	88
PID 3020 wrote to memory of 4856	3020	msedge.exe	88
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 4460	3020	msedge.exe	90
PID 3020 wrote to memory of 3392	3020	msedge.exe	91
PID 3020 wrote to memory of 3392	3020	msedge.exe	91
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92
PID 3020 wrote to memory of 4712	3020	msedge.exe	92

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://r20.rs6.net/tn.jsp?f=001ta38JYWYcKTTeblftvgzKAd7MLs3U5aQoN-UJNPCIW6trFFnVp4hcO364Qp5Xf10x_MiHSwpjpnywLH700NIJD3APHF22hVcA0BX2cWvF1mJ7B0ooBwPeuM8rzDFkSCwI5vLuTLCt-I=&c=&ch=&__=//css/content/newfile//064/fhi/YWxhbi53aWxzb25AbWVsYm91cm5lLnZpYy5nb3YuYXU=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x9c,0x108,0x7ffcbcc246f8,0x7ffcbcc24708,0x7ffcbcc24718
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2516 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3404 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5708 /prefetch:1
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,1807870333820077552,2778135744281199409,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:3904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1664

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 af80020ae43388bbd3db31c75aade369d489a30a933574dea19163e094d5f458
MD5 208a234643c411e1b919e904ee20115e
SHA1 400b6e6860953f981bfe4716c345b797ed5b2b5b
SHA512 2779b96325234c836cbb91820ee332ed56c15b534ec0c7770b322a5c03849ec3ee67b0ec7978e1fab563eeed1cea96f5155d7b942702555d9352ff6711a548d2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e3ae23c0bac1df340eba876cf6485ebc427f94362e80f9458c4c66d42f7383d1
MD5 4117e30a5a0e76df34b74b4e4b640f90
SHA1 2d61f6bd9b2ac5b13b0ec2b200da051915e18345
SHA512 16fb91cd5877d99676cf0b98322cc199c0be45e2837cc485ba6636606922c3ec89d1324cf3ccb4883931efbe62dd5267c8cbd83c767f34587cd4dd61be413894
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 1909046ba0a97bb3c7479433bcb10e0428a0e85a0ae076e3f93949ce119698d2
MD5 e38825d866235494b9d535ebb7f7d665
SHA1 9a23d6fdbebcb84be47d6ce77918bfbb1d800268
SHA512 f4fecffa0ae61d841cf5eaa2fe5976f401a76a636b769cbeca2300e322ae465d48378edcc4136c9fd390de835dca0b5a4f153d53bb458e2f9394f503be3d4406
SSDEEP 96:nBdbkGRj1NeOqwpvWMoiP1R5mdeH8utp1jXT4DybP3UWQyV+VD7AiEwb:nTbk2fUGWM9qujhDNfrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ab513a93ef6579cbdf3638cdd93703661c1921adb2ebd25c2d75ed450ec858a2
MD5 969eb8cd11f2f5dfe55f262c26961563
SHA1 9e9276ef2402e64fac036bacadd99f7ce1586600
SHA512 9c8032a4d402574bfc0dabfa1911cb500e827dc1ba02295641ed079b943bea2ec9ea59cc6298bc94d48abdd6494bd7fae5c7cc3cb9cf86054b1e91fad2c4fb08
SSDEEP 96:nBdRkzRj1NeOqwpvWMoiVmdeHXTtbP3UWQyV+VDCzia:nTRk9fUGWMXD9frj
MD5 SHA1 SHA512 SSDEEP

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 24KB
SHA256 0a9e623c6df237c02a585539bffb8249de48949c6d074fe0aaf43063731a3e28
MD5 5a6206a3489650bf4a9c3ce44a428126
SHA1 3137a909ef8b098687ec536c57caa1bacc77224b
SHA512 980da83c3142bf08433ec1770a2ec5f5560daf3ee680466f89beae8290e921c0db677489daad055fbc1f196388f8bc4f60e050600381f860b06d330062440a78
SSDEEP 768:nT8W/L8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNLlD8rUmu:nT8W/Lu1jaYLZmu
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 17df83f8bbd04dfd5273276eb1d2509a0ffe23b87d3533d083c8110be5765de9
MD5 b12a1ecc55127976df9cad69dbba9fce
SHA1 35b796ededec0f6727c5ad2a9ad8d2bd5aa4370c
SHA512 627c376de978a0faab3a9be330659aee4bbb9bdc908a255431748a5be87d9da5b847d9631b9fb2598489ba0496debe89bfeeed00d56d5013a00baac22952a155
SSDEEP 192:koCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxF/Qgce2RUh9b4eE0LQNkO:E9iIxuERzA83h09RZxYxFyzwGR6DK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 f19fc54d8c9946a413d229f823ef7a7b307bbc5620780bdc587bf91f589d982f
MD5 c72fd7f25d7ead8367d30a28ce8224dc
SHA1 0961a996f75080e2b151cb2efd341dd259f4baac
SHA512 01a4ea6d5f463c68a71422177b935e682b02f6651b4324d529a056fb5726d71233b2453b5b0b819b070f06a4339024571ade0c41ee04eef3ce607230c679e659
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxF/Qgce2RUh9b4eE0LQNkO:A9iIxuERzA83h09RZxYxFyzwGR6DK
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 986edc18d0c4ca75305783ad5ff828de985f63cfaed7569ed6174ec75842bf34
MD5 0950893b41a79ce753c92bf0f8e5ce4e
SHA1 2038ef7a1f3b62760b95e991b7ad8fa944ffae37
SHA512 3b224c6f1857c5d45e06a41ea95e8c599b0be5b34e6f66ce189d1ad162417c1d523b7679d7ddecfd2c9dfea375249776f9c122b5cf3466f3af2efa380ddb98be
SSDEEP 192:yoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupxF/Qgce2RUh9b4aE0LQNkO:G9iIxuERzA83h09RZxYxFyzcGR6DK
MD5 SHA1 SHA512 SSDEEP

Submit Download