hxxp://track[.]mealgate[.]com/?xtl=1dwllwvqm9of2w8grclcvv0nalbbjdcer6nva0mdfydt6752sjpkovo6fz8cwwtxdc8ki8973mi1opl9upv4je39j5euj9m4mg5komwpdmfhmi5fr5vug6huf7q3mmixm8yrragrty7b0zkb0lh3vnyh0or7mqim2m72cuq9lcxsv79c7yiv4n6xgvuofe5jjyoe4wb99iac06y7r744o6vz1zfagwwt1smdqm6u0j91xuyrbx8h8guau0q88lct2lj1&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sbmqlk&email=rcolwell1@ewu[.]edu&first_name=Reynard&last_name=Colwell&newestsource=&Source=&YearAdded=2023

max time kernel
138s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/04/2024, 19:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://track.mealgate.com/?xtl=1dwllwvqm9of2w8grclcvv0nalbbjdcer6nva0mdfydt6752sjpkovo6fz8cwwtxdc8ki8973mi1opl9upv4je39j5euj9m4mg5komwpdmfhmi5fr5vug6huf7q3mmixm8yrragrty7b0zkb0lh3vnyh0or7mqim2m72cuq9lcxsv79c7yiv4n6xgvuofe5jjyoe4wb99iac06y7r744o6vz1zfagwwt1smdqm6u0j91xuyrbx8h8guau0q88lct2lj1&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sbmqlk&[email protected]&first_name=Reynard&last_name=Colwell&newestsource=&Source=&YearAdded=2023
Sample240409-yef6dsga66

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4768	msedge.exe
4768	msedge.exe
5088	identity_helper.exe
5088	identity_helper.exe
2740	msedge.exe
2740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe
4768	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4768 wrote to memory of 2812	4768	msedge.exe	77
PID 4768 wrote to memory of 2812	4768	msedge.exe	77
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4656	4768	msedge.exe	78
PID 4768 wrote to memory of 4608	4768	msedge.exe	79
PID 4768 wrote to memory of 4608	4768	msedge.exe	79
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80
PID 4768 wrote to memory of 2860	4768	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://track.mealgate.com/?xtl=1dwllwvqm9of2w8grclcvv0nalbbjdcer6nva0mdfydt6752sjpkovo6fz8cwwtxdc8ki8973mi1opl9upv4je39j5euj9m4mg5komwpdmfhmi5fr5vug6huf7q3mmixm8yrragrty7b0zkb0lh3vnyh0or7mqim2m72cuq9lcxsv79c7yiv4n6xgvuofe5jjyoe4wb99iac06y7r744o6vz1zfagwwt1smdqm6u0j91xuyrbx8h8guau0q88lct2lj1&eih=1l5wnyt7mvmj0rn8kf13pz70crct&__stmp=sbmqlk&[email protected]&first_name=Reynard&last_name=Colwell&newestsource=&Source=&YearAdded=2023
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x104,0x108,0x10c,0x100,0x110,0x7ffa3e153cb8,0x7ffa3e153cc8,0x7ffa3e153cd8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1896 /prefetch:2
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1864,7314610577332172719,1698923886869143343,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 7fccd8c81f41a2684315ad9c86ef0861ecf1f2bf5d13050f760f52aef9b4a263
MD5 3b1e59e67b947d63336fe9c8a1a5cebc
SHA1 5dc7146555c05d8eb1c9680b1b5c98537dd19b91
SHA512 2d9b8f574f7f669c109f7e0d9714b84798e07966341a0200baac01ed5939b611c7ff75bf1978fe06e37e813df277b092ba68051fae9ba997fd529962e2e5d7b0
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 5694744f7e6c49068383af6569df880eed386f56062933708c8716f4221cac61
MD5 0e10a8550dceecf34b33a98b85d5fa0b
SHA1 357ed761cbff74e7f3f75cd15074b4f7f3bcdce0
SHA512 fe6815e41c7643ddb7755cc542d478814f47acea5339df0b5265d9969d02c59ece6fc61150c6c75de3f4f59b052bc2a4f58a14caa3675daeb67955b4dc416d3a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 960B
SHA256 b7d8995cb6b140599a684134e095c0830740d0b6b231924f83301bfa1922de1b
MD5 26f73cb2c5271230051d6876715fd642
SHA1 9c9b95a9b887efa47f59f32383b232201913a8f6
SHA512 252b28794553477e2eafe9a17f738752c15c15bb4698e5b528f771c62adda8c08e26dddb9ef83b60b9510646e75aabdcca08f77f030cc6c94633a9a49e5dd61d
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 3KB
SHA256 db28a38c9d13faab558f27ea10a31b68b335c16b0314666a71b3a84e6e643b1e
MD5 d40988654c401b98d70934ce0691f863
SHA1 449cb6170c4451b43ddb225530f79e94d135ee41
SHA512 ef45609c473caa28a89d0ba8e51660062519acb3380e286d0759862d36d2837b9d694c09cf4bb366b9b2d5ad5dc777de6309969c7bd458368a988f2db98d076e
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 bd6707b551355c5fbb9433b0e9d6e41f17483e2213b90dce9c49e5dce95086ff
MD5 9860f83d1b23197dafe8e1c00878dea3
SHA1 fc8981b9c822491dfb8a1b30d703b690d5d46c73
SHA512 161f5d7368593e35347d270cbcfd067d30401064b33f2feccf06c0290062178d2bd447e24f96a31eeeb2f3446dcbf6087ef6037e6d4bf7e65cb390885f047ab7
SSDEEP 96:n2k3ptzuk1GwSv0MoiVmdHI1VJDuQU40WQyV+VpziX3wI3:n2k3pluk0v0MAI1vDuQU4Lx93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6322ad010bd5229b635e55ab7fb6be31b2284de48d0c59c50d8ec7e9bda4c451
MD5 a944469ad665d50e881678ecd1cd40ae
SHA1 eb5927bb7b3079346e91fcc4885e4e08120b4c7d
SHA512 d2565f906cc84fc1baa7a980edfc0ba092fa685dab701f2024879fd61e7b4d17c3d81b998e47c464dd18ef59fd2594ea5d0c38e81e71e0b1b249964a524da4dd
SSDEEP 192:n2k3pJuk0v0MMuksn90EVVF2I1jDuQU4Le93:n2epJukw0LszVF1jDuQrC93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 cbc9105d72e86862d45bf2726336db729e55c70721f8fb034e9134630f8b1e1c
MD5 add6ceed8d35021ba0fa5ea02d67f076
SHA1 d8ad41ea3272ba943a2327b53189aa18ea518d83
SHA512 28d2b26ba20251d33ad158c8420f49cff87ae77863a64ee274b3e16b7c01d09e176ec7080d580612b605b156acc2aa757f832da41c89c79261258286bf333101
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGwSuG0Qte2RU97fdRxhePi7+4:M9iIxuERzA83h09RZxASGwmU7fphei7h
MD5 SHA1 SHA512 SSDEEP

Submit Download