hxxps://0zrj3[.]mjt[.]lu/lnk/AV8AADj5PhMAAAAAAAAAAeOyNUoAAYCrw0wAAAAAAB7XEwBl6Yl5E5TIqIrFQJCdOn3rEYKZ8AAGLUg/1/67GbgOa20-af-TEw7jkuXg/aHR0cHM6Ly9pbmFpbC1wcmV2ZW56aW9uZS1mb3JtYXppb25lLnNhaWxwb3J0YWwuaXQ

Resubmissions

05/04/2024, 07:14

240405-h23pxaef7510

05/04/2024, 07:00

240405-hsrw2sea4x10

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
05/04/2024, 07:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://0zrj3.mjt.lu/lnk/AV8AADj5PhMAAAAAAAAAAeOyNUoAAYCrw0wAAAAAAB7XEwBl6Yl5E5TIqIrFQJCdOn3rEYKZ8AAGLUg/1/67GbgOa20-af-TEw7jkuXg/aHR0cHM6Ly9pbmFpbC1wcmV2ZW56aW9uZS1mb3JtYXppb25lLnNhaWxwb3J0YWwuaXQ
Sample240405-h23pxaef75

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
5040	msedge.exe
5040	msedge.exe
3864	identity_helper.exe
3864	identity_helper.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe
3468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe
4688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4804	4688	msedge.exe	86
PID 4688 wrote to memory of 4804	4688	msedge.exe	86
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 2292	4688	msedge.exe	87
PID 4688 wrote to memory of 5040	4688	msedge.exe	88
PID 4688 wrote to memory of 5040	4688	msedge.exe	88
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89
PID 4688 wrote to memory of 1228	4688	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://0zrj3.mjt.lu/lnk/AV8AADj5PhMAAAAAAAAAAeOyNUoAAYCrw0wAAAAAAB7XEwBl6Yl5E5TIqIrFQJCdOn3rEYKZ8AAGLUg/1/67GbgOa20-af-TEw7jkuXg/aHR0cHM6Ly9pbmFpbC1wcmV2ZW56aW9uZS1mb3JtYXppb25lLnNhaWxwb3J0YWwuaXQ
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffeac6646f8,0x7ffeac664708,0x7ffeac664718
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2052 /prefetch:2
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4796 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,12992981174067984327,9463844010142151804,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 a43f82254638f7e05d1fea29e83545642f163a7a852f567fb2e94f0634347165
MD5 e494d16e4b331d7fc483b3ae3b2e0973
SHA1 d13ca61b6404902b716f7b02f0070dec7f36edbf
SHA512 016b0ed886b33d010c84ca080d74fa343da110db696655c94b71a4cb8eb8284748dd83e06d0891a6e1e859832b0f1d07748b11d4d1a4576bbe1bee359e218737
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc773d1928f4a87e10944d153c23a7b20222b6795c9a0a09b81a94c1bd026ac3
MD5 0764f5481d3c05f5d391a36463484b49
SHA1 2c96194f04e768ac9d7134bc242808e4d8aeb149
SHA512 a39e4cb7064fdd7393ffe7bb3a5e672b1bdc14d878cac1c5c9ceb97787454c5a4e7f9ae0020c6d524920caf7eadc9d49e10bee8799d73ee4e8febe7e51e22224
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 1KB
SHA256 28bfbdb24aa14f25a1748ffb8497ea4a8ee53a973e34cb6a9d08d999a05b81f0
MD5 01354ab84ce7460a15cee6fbbeae3c29
SHA1 6ff9e0201a80044ef22e2863ea10cda77ac99678
SHA512 0bbe01d2bd9ae0e4ab62957fad8a77f822e58a242b29c7096e700139c1e8535fd5a5cf9be7f1f3a3df5c931681579b440b70c57a81249dfcedc8d224ede53e0a
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 eda21fc64578344a526b17fc930ca5a6ba1cba3631b6d9642873c50318629ded
MD5 d1ad449103c1368d6626bd6a36e51709
SHA1 a67867889e3ef9ab998107d2c81d12185ce27fc8
SHA512 c44bb5bf45ffe2f6b83be79e5a3581154bb20a407d8265ef648c562732802c49810b517577fd143f1c729771b266d03647772c9f586dda419dde30f9357a2661
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 facd2bdb582c21847ff94da01f9a291a15d945cd7ca8cc281e3e663bb7444285
MD5 878ff68af5458097dee2f25116464258
SHA1 905783f484abb7a2253b8250305171e3708f00f3
SHA512 298e88a7189ee8a70ca688298fa3cea66f77fd530e2e50a9b6879bc05e2c6b05421083d898d4d142a471e8a4eccc54f4bfb22c6fe2be09ba6c861bfc4837d83f
SSDEEP 96:nhk0V1QZ9jawpvWMoiVmdeHbeHLUWQyV+VD7ziEwb:nhk8CHaGWMXELrt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 335cfd530359a98ed28cd23efed1920878c2c2142a32fd6cc2823db5cf444f02
MD5 db8f1e88242ef842cf273282cb247e2a
SHA1 d230b899e7513fac629d84d4e3aecfd424ff2395
SHA512 f22c5ae4b3c8616e39bd282308898b456eb73d1c9b75a21c6e2c391cef7eeaf6896c85e617545f97a1420f4d2962880a703ff571e7a5f920be33c1d0921558df
SSDEEP 96:nhkqV1QqOB9jawpvWMoiVmdeZYeu341tqbCHLUWQyV+VD7AiEwb:nhkuCN/aGWMeeuobqYLrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 01bdf968f5c1f472ebde3dea121d1d14f19f27507d746e1d1d187c5197b24779
MD5 82f41ae52afb73aa037ee735e781c9bd
SHA1 b80ca3d8d831e722af771b376ffc436bc2c98601
SHA512 65679f69712fd3a3483c1b1fa8b81e114e67dc78890573cc72264573b393ce7fe25e82d1bc63cb648fb1c145d3fb0eef81ec2cad1ca58857ba1b002966917b58
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe58e673.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e673.TMP
Size 1KB
SHA256 d8509d982a21afad572477da123958ce0e7ddf7b365805e7c2078e31310e4ec7
MD5 d30f91ad920e0eea37549d74fcb06757
SHA1 6fe2a3b749e5561267f6504ee82e76dfbc91bb0c
SHA512 ed945d4ed1b28a096ecccec8cec14c314dc97fc450a2dc494f5b927833e463d5a6728d4a5e7a32c10985502532379dec7d02d20331274ae9a00e96d2aaa1db6b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1a84d4a953810726f0c11d3c3d13974ccc3b0a24199fb1770465aaaee848c37c
MD5 74df27ad63447016e6981a5347fbf4a5
SHA1 df842f26de46d18271f59877dc8a5d2c75313e4b
SHA512 3da80af3ed8f002ccd6740005584ca1d4ac01df944342b80dc72f7202cba6557a157cb8837eee0eca8882ce1350b5f11c832b86f102773a0f7c2aef227fd5eaa
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup8df5ie2RU7Flb86xvFt2pY:A9iIxuERzA83h09RZxYkfej6Tt2h3CoA
MD5 SHA1 SHA512 SSDEEP

Submit Download