hxxps://snip[.]ly/5zdik8

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21/05/2024, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://snip.ly/5zdik8
Sample240521-fdx4eaaa8v

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4504	msedge.exe
4504	msedge.exe
1688	msedge.exe
1688	msedge.exe
2448	identity_helper.exe
2448	identity_helper.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe
1688	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1688 wrote to memory of 3588	1688	msedge.exe	82
PID 1688 wrote to memory of 3588	1688	msedge.exe	82
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4404	1688	msedge.exe	83
PID 1688 wrote to memory of 4504	1688	msedge.exe	84
PID 1688 wrote to memory of 4504	1688	msedge.exe	84
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85
PID 1688 wrote to memory of 2244	1688	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://snip.ly/5zdik8
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff86ae746f8,0x7ff86ae74708,0x7ff86ae74718
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,4946100747573060226,5751861572360220739,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 144B
SHA256 58bd0df4c57661d5431893553ea9ffbc3a5cf20470fb9596bb845cfa0ee253c6
MD5 e5773f373316689356ac665e5fdd047d
SHA1 87c0968091bd5f0fc91bfc8ebe5756abc894a302
SHA512 556d2db33cceddc4c787dacb0aa0e1bcb31c64c8596fa3b798efc174db410d10f2da910512fa1aae00325c533964ec164b687c785cf3b97844486385df66ad24
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 627B
SHA256 cd20f809d17bb27b34436f55484634c5b7433e484536c311b886c150eab37a93
MD5 3833849b7937e1323ab20b8de419ccab
SHA1 54deaf5d26b16e362764609410b10104bda0244d
SHA512 d677a3b2ba1eceb33482e9ba5a1b144839e49e8a65076c1e0cbfc7ea5a945c7a06b425cf7f33d37e35d43bb09ebf93f502dee1a94a3cd0e2f7d5796dc2bfab2a
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 5d147eaf3b2f1608b7b886e81b108af44bc02aed5a4dffb950fe9ab77dfb53cf
MD5 082d5970560e9cda80df03766afe2519
SHA1 d34c633ab383829420c488b455b7162b67130d72
SHA512 11e6039b800c78a1fc6aa87782a7541716f555b50a2780680891f500edc6fe1fed46cc70663ed5c30578d53ec73e9015239d16e9433574d801c85b874897108d
SSDEEP 96:nOkhn1AgjuwpvWMoiVmdeHvSSeEFAUWQyV+VDCziEwb:nOkFCgjuGWMXcEFAro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 9bebca2a8ffb17beed44367aa43d6a5ecfe1a6114cbec3c0e0a0001a58e42731
MD5 d36748fed5bdd8b42d4134bf7c49ed75
SHA1 1745379542d8917c5405c7dab25cefc3704bdcbf
SHA512 7319e2e47e320bb0fa3a4943c6ef8fd2f59da18db09f3745a36cf377bf9b4809cc24f89a331a0e209241de9a9de505bd2bacde3384ed5c954c9bb7451a56f7ef
SSDEEP 96:nOkmn10wjuwpb/DWMoiVmdeweuD1jvSReEFAUWQyV+VD7AiEwb:nOk0CwjuC/DWMgeuDhLEFArg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 96726d3ce0dfb56082049e3a1b9fcfe8684a6818ed54cf6272a06b1a6591e013
MD5 619d7a4b0b09d2f87b3a2d8d6b3eca58
SHA1 a11b522eba31b395935b984c7ec74cc878c435b5
SHA512 e1fb8dc723c366f5cd8624e03f7e8c140f3e05b4a3d05d4a5995032827398778c013234dfe14ffa27b2f97d93211b380adbeff253b4c0a06c09e33b576a4949e
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup2he2RUAj4u/3z2OMDCRHq3:A9iIxuERzA83h09RZxY213/aOMWRHqlF
MD5 SHA1 SHA512 SSDEEP

Submit Download