hxxp://kdltslmrjmjfxfp[.]lehoihoadao[.]com/jdhgcreshwa

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
19/04/2024, 01:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kdltslmrjmjfxfp.lehoihoadao.com/jdhgcreshwa
Sample240419-blcefscc54

Score

10^/10

phishing

Malware Config

Signatures

Detected phishing page
phishing

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
3528	msedge.exe
3528	msedge.exe
3064	identity_helper.exe
3064	identity_helper.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 116	3528	msedge.exe	85
PID 3528 wrote to memory of 116	3528	msedge.exe	85
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 1836	3528	msedge.exe	87
PID 3528 wrote to memory of 4772	3528	msedge.exe	88
PID 3528 wrote to memory of 4772	3528	msedge.exe	88
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89
PID 3528 wrote to memory of 2140	3528	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://kdltslmrjmjfxfp.lehoihoadao.com/jdhgcreshwa
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9c39d46f8,0x7ff9c39d4708,0x7ff9c39d4718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16162263020254854043,14672150499940634810,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 1e839706b748c04adf8efa2790564ca1efd707fdf6451e71af6862e07123717e
MD5 8c91c8582b0c918416d14bd7eedd686e
SHA1 b2ff8149bc21144fdcec64111afda492965c6621
SHA512 a93be868d9f08097bff39069378a0bfa0f5c78e74e9e8df820be9b0426cbfe84e03e9638b329b6142279ed140a120c4c4c21857f410fc4789a370445c3919dcf
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b8443c289ad36568a2bf794ac9ec1f259a9dd930c36680dafc8d0cb4de81feb6
MD5 2579d07b98bbefadc929d80fb3dbd32a
SHA1 1ceb57c4b81f0f23500e118a4b9a225116a467de
SHA512 53522ad5e8e2a272d5b1bff9b9226b7d976d47413891c60d7efebd4365baff12b6891e3f79b20e14892ec7c654ad2d437941014290c428c6b1bd78a7b3e557de
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 6b754d13c922cb20553978223b1001ecc8f4136b26f522d7b0c38a1943dd92da
MD5 e1ca9b490924d72d426681ca0acdb041
SHA1 079faf32068c835cfb6c771b45c447ccbb694de8
SHA512 eb5834f4616088785e8ce38f989322b02ba92a6438b581479769f5429e00a171cbf01483ac81823fcb389487c3cf369ff075f81a9d249797306b5abe82c24fee
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 f6e55979829e4f8a25be8bbf826d9f50354ee515b75e7990614ba3eee0241d2d
MD5 5e7862fbff9400a6dd69d5feb7003208
SHA1 279468f9d27f9870994317a25c59cb078ac3f3c8
SHA512 4cb0fcef445aa7da808970441563e0926b31436d581ced876e90f624fa7b3bf50a0b0951d9fad0a923c8d9e209d2ebc366ee1c329822704a1afed97f20b528a8
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 176302cb62d78f0885ede35697326044b28ebc5ca508b3af02412dacb206abac
MD5 1272d05dae70cbba181b6bd2a49d7e6f
SHA1 95944dada7b039edb229716bd22cb95e52b1f382
SHA512 4080cb17161437ad4088f29c90a3ba948eadda24519fc2af80265bd3006b287d279a37ce81f45ec863327796360f89328628029ab4c0004f681361fe9b00aeea
SSDEEP 96:npk2vxm/YQYmqV1BPtwpvWMoiVmdeH7VIuWS+UWQyV+VDCziEwb:npk2E9e7PtGWMXiuWS+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 7KB
SHA256 c22bd48310892766ed05bba27f4882573c6e681a228bccc9bdc4e5ade7fa68c0
MD5 89b57f57ea1e03b33f4e288e016605d5
SHA1 364f529a9381c572d788d1ebf83db2bd260d6cee
SHA512 4dd405d9cd9efd2fdfb3d03bb51ca1d17774bd8c23979918d0dc969f901dfca021e334b14565c55dc2272c5fad4315413f766295b77197db5d061e47df182303
SSDEEP 96:npk8sQwvxm/Y4mqV1hPtwpvWMoibR5mdeIui1j76IuWS+UWQyV+VD7AiEwb:npk1EKeHPtGWMbauihPuWS+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f0a2d81e91747514e8a114c27b4085c917e671d10bf8aecd8df11e23c8643bc1
MD5 c9086bc5f7a3da92af262c609a0ace5c
SHA1 78b365c5559acbb63be9c88ba369668030c91205
SHA512 94e2ef845db9780642a5a105bee2975e0b673ea91fbd8bab6b4e362f6258b216eff031ff744ae0cf6d1769e7fdf66c7a7bcbeb3fbcb86bb733d3eaf2e31fcab5
SSDEEP 96:npk2vxm/YnmqV1BPtwpvWMoiVmdeIui1j76IuWS+UWQyV+VD7AiEwb:npk2Ene7PtGWMYuihPuWS+rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 b514a02ee6153b19a66d18a90231457d8e96f3ac8826528c996262b67968899f
MD5 f0465e67b349dbcd9fcdde61d5f18ede
SHA1 240915553fc39aa17c849f572261ef0af9e22c74
SHA512 f9782144f5e3c5af5cb60b4be1ab1b57f73d050baa1204e33b902cbdf7a052f85cf9e88175904d6f30a6faf85f3d3dbb7572fd6c64e92840f342439dbfe7b9e2
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57ca16.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ca16.TMP
Size 203B
SHA256 0b6d8e03182c1a5856b3b723da99c3ea360db9b3cee1383b3988dcc9c76e6c5b
MD5 a6616556ac8c564bad284caf0fea67e2
SHA1 d5d4d51a87d2b7157ae4938dcf5e83ab5c38a9b7
SHA512 351ae4482e03cd645d14b13f88c8283af4ceeb9a0b61bc840c75b25b0ade844a724ad73cdf65d7052047a74b70f9234849182ad5ee3aa999155c3108acb0ae78
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b5467dd68260a38b4d85116c4000dd21fed77fe9d44ba22e94b26bcf2f4e2e36
MD5 fe0b7bc0f6686e7d63258931bc5a248b
SHA1 13d5198e621f080cadbdb692a815dfb446ce507c
SHA512 ecbeecada47c2200e4d33d4f410cf61c9bf6651f7499a8dcecf5feaf42994e4df02bc78cdb99271486062747ccb7d47a7eefcef59fff7c7c7a1495dba4221bb4
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup+Lye2RULs+uCEdP4M+olz6:A9iIxuERzA83h09RZxY90N9sAKO4UJy2
MD5 SHA1 SHA512 SSDEEP

Submit Download