91d8854922c631485f279d03420c0c982299ae73bc92f708111e56334de415eb

Analysis

max time kernel
1779s
max time network
1685s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 09:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2859.html
Size 27KB
Sample240603-ljtk3aac2t
SHA256 91d8854922c631485f279d03420c0c982299ae73bc92f708111e56334de415eb
MD5 c27505824db97f1fccc26af338bb50f4
SHA1 bd8fe4bbc04f70f280a6f143ed2aa7f1843d4438
SHA512 80e9f18b5b40b2a74fcbda71101952102c0fb772bf27b804df91c6bfd5fbc06f78e202bfcaae501bf465035b06fe947a33ce5a4ee44f88f84187a436c286176d
SSDEEP 768:QuV4raLVrTzTzTBT/TZT4TNToTJT9TXTeTGTuTv8TKT7T0T4TXjTaTCT2TCTMTaU:LEaLVrPX9LtkhEFZTC6awW/4Mjjeu62y
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2728	msedge.exe
2728	msedge.exe
1876	msedge.exe
1876	msedge.exe
4636	identity_helper.exe
4636	identity_helper.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe
1424	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe
1876	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1876 wrote to memory of 2872	1876	msedge.exe	83
PID 1876 wrote to memory of 2872	1876	msedge.exe	83
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 3064	1876	msedge.exe	84
PID 1876 wrote to memory of 2728	1876	msedge.exe	85
PID 1876 wrote to memory of 2728	1876	msedge.exe	85
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86
PID 1876 wrote to memory of 1940	1876	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2859.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffea6ed46f8,0x7ffea6ed4708,0x7ffea6ed4718
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4072 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,11352194097391412623,6201371090003722741,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2472

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 96B
SHA256 e21ab6e5d27203713c0ab3fdfafa903699ea749df571cea79fc7d6823bdbe5ad
MD5 93cecbc8c19cb51d7e512907ea45f93e
SHA1 7ab2519d4b18824f20d4dab3cd11da73f0f8ad33
SHA512 02bf805778c845c73c0a7a12f18a65d85bc81d0d60b098ab75ffdb65a47f001682406b6dcb253983e5667ef6034f03e499f33b02786f12f45e895fdb8bfa1751
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 512B
SHA256 3afb0a58e69b0cb7f469780682a815e4067d41ff97b791f9a58347df264d2c4d
MD5 966a3981189fe38bcbf8a1caf43d8e2a
SHA1 a37c4a7b2a0f5caa73a9d2fd9a60dc01c1a97c4e
SHA512 48986f0ce77899ebea821c32f1581a3c1b73fedc21a737598bceb32c399d5287e5116d39a7753f48097da24d3195b2054f44b2a8f76f61d4728b5b30c9003cd9
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a9805ba7dcb766e532bfef052285ac9c8bf62fd16fa0c5b52795cccfa3ca9de4
MD5 1282f373c1e076ffc783e481dff9d51b
SHA1 1260820843f8ecfa40425447619d85864cd1d437
SHA512 39de4b17a29d78d82f49bcd0b720500f2cc3a31e6d491df04eea7a8cfe6f10c34d0a8c72ddaa6906aefeb61840c9bbe15e9f6059b71c953862367aff4246b178
SSDEEP 96:nSkRla1zBwpvWMoiVmdeHBrzZnQ+UWQyV+VDCziEwb:nSkjaxBGWMXLnQ+ro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 d3ffd0ed3b1e5c1196578c0fa2beab9f4e5402eebc56a10d5e8be464202e6f43
MD5 6eebf4fca9961b0cb7cd294330a8b78b
SHA1 e200d444bf7d3ee575e45244007bf74cff921c07
SHA512 7ed157aa0970cffe3458c33def245f52c89b49f3d67a303d25a394ce801d082a51d49d6bc0d3cb63e8e5c4657ca448ac9e8ecb8842511ca58da0ac997389d337
SSDEEP 96:nSk8la1zBwpvWMoiVmdeHBrzZnQ+UWQyV+VDCAiEwb:nSkKaxBGWMXLnQ+rV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 705B
SHA256 e748c44d12226eda4dc57bea3ddb5ac823a79018996e9b8bc51523240e8b1c35
MD5 e2e0c2e96def74e979cce2847b72a818
SHA1 fa71a9ea65415c85720d91b3f7532aaf8c73214e
SHA512 544ae18586115b28d2cd3a0b6a938dee217d1afdb26f5781ac45bca423987b42f0c90dc5b24d93db8af77ca3237f91a858fb3548504b7d38c28024c421ee8505
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57d428.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d428.TMP
Size 203B
SHA256 dc0b5facbae2cdac59f788b3b74285985dbe00b14cc7ad722a0527e9395c291c
MD5 d3c4686219f28af8441c596b868bd4fe
SHA1 249439834f62d02f261a61e4a51f489b764a2360
SHA512 29504ae17c8869259db3da7a25e041a4d38230a25e95cbd595d65ae45158b8ae9bba6927c84d9344a22b54ce010f6d05738d2e3f7476c28d95b05523f17b645f
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 478a57c00996c294b283cf7572da30882cc36f199b997f37ea3269f83969ef57
MD5 a72ef9c74eabd4a597e2211ef75d0340
SHA1 c9e5b8005f5d94842177cb63b16995f4d46126a1
SHA512 4516da6a3bab61b815e88518487e5bbcba9146f127631cdd993a9424c6f8bebbe05dc86a24c4037aa03066806aff0d693582bbd9ef5aa42cd26d9dbfdc1df5c8
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupAH9e2RU7cJMj2A3z2OMDCg:A9iIxuERzA83h09RZxYAHZ0yAaOMWRHi
MD5 SHA1 SHA512 SSDEEP

Submit Download