hxxps://click[.]cmpartners[.]nl/1/5/1506/31/Ra5nOvJXv_rhyhNvEBTj8dsyBTsYJAbBhGnyDnNn_ammzFGiu_KDEh5ZYSalHcTpqs556sRbEHsvq-lOqAI7A_Zc59TfjTCx1wJrOXWUM2QEsgFssR334ZVxW_t8IxOr0cfu_y7Imu-_yQqTPDQ5hegu2EJ6cy4uPbyFlg

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://click.cmpartners.nl/1/5/1506/31/Ra5nOvJXv_rhyhNvEBTj8dsyBTsYJAbBhGnyDnNn_ammzFGiu_KDEh5ZYSalHcTpqs556sRbEHsvq-lOqAI7A_Zc59TfjTCx1wJrOXWUM2QEsgFssR334ZVxW_t8IxOr0cfu_y7Imu-_yQqTPDQ5hegu2EJ6cy4uPbyFlg
Sample240603-mlny2acf85

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
2340	msedge.exe
2340	msedge.exe
4676	identity_helper.exe
4676	identity_helper.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe
3708	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe
2340	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2340 wrote to memory of 928	2340	msedge.exe	83
PID 2340 wrote to memory of 928	2340	msedge.exe	83
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 4316	2340	msedge.exe	84
PID 2340 wrote to memory of 3952	2340	msedge.exe	85
PID 2340 wrote to memory of 3952	2340	msedge.exe	85
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86
PID 2340 wrote to memory of 1484	2340	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.cmpartners.nl/1/5/1506/31/Ra5nOvJXv_rhyhNvEBTj8dsyBTsYJAbBhGnyDnNn_ammzFGiu_KDEh5ZYSalHcTpqs556sRbEHsvq-lOqAI7A_Zc59TfjTCx1wJrOXWUM2QEsgFssR334ZVxW_t8IxOr0cfu_y7Imu-_yQqTPDQ5hegu2EJ6cy4uPbyFlg
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff825a646f8,0x7ff825a64708,0x7ff825a64718
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5684 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:5468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,14836234589539844056,11810115181847313502,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb
MD5 a8e767fd33edd97d306efb6905f93252
SHA1 a6f80ace2b57599f64b0ae3c7381f34e9456f9d3
SHA512 07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654
MD5 439b5e04ca18c7fb02cf406e6eb24167
SHA1 e0c5bb6216903934726e3570b7d63295b9d28987
SHA512 d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2
MD5 SHA1 SHA512

Submit Download

f_00000b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b
Size 206KB
SHA256 374db366966d7b48782f352c78a0b3670ffec33ed046d931415034d6f93dcfef
MD5 f998b8f6765b4c57936ada0bb2eb4a5a
SHA1 13fb29dc0968838653b8414a125c124023c001df
SHA512 d340ae61467332f99e4606ef022ff71c9495b9d138a40cc7c58b3206be0d080b25f4e877a811a55f4320db9a7f52e39f88f1aa426ba79fc5e78fc73dacf8c716
SSDEEP 6144:rByHI/jQOq4dOccc0mN2EsmCkJO6hBXUmoq:rEo/jJZd+IZJR
MD5 SHA1 SHA512 SSDEEP

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 432B
SHA256 0fc036fd46da120247a03c751c4c8aeba49789d632f1f4a77cf5205a46133ea9
MD5 d3a34bd7d03464f11958b1332ecb2a34
SHA1 fcff96495ae0ddd52bab57e98bffba4c68c329c2
SHA512 73ef853de58d0be4669a3cac40f54983d598af3618c14e344ba35da4ccd9822ea61da4c8d07a79351a49f62674c6a9f73ffaac9b5e399292e98e79d45f633be7
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 b9d94fccf55d16448a8aeed99b4990b74997db07f5e0f2ffbf0c276f3eb20ed6
MD5 d8eded9d3ea17cf763a7adda6a59c580
SHA1 f0f96367ee13566fe56c31670575f3b5b94888e1
SHA512 1c0b41237a21f833dd02af37a1972dbbfa6ee155b4f990348aa5fab561216dfab171879180759f7c2012db51c5251911ea9cbf109bc6710e08deae0e2b87117b
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e4bd019d5fae9471810d5ff1277ca9e65c48e7c3028b6a77ed842984615aab03
MD5 753557eeafd5fd304dd896f060f6bf36
SHA1 dd5ac7858d33294d4c4de43791f0ab6bd2f3d515
SHA512 168e28c452e00d9fccd57374487886f8e7cc34c4e74cd4e83fe60c10824619fe506cac63fc9289ca600709150fa2b9a4c0ed8078c049836e320b9666b00feb6c
SSDEEP 96:nCAkfK1uU1wpvWMoiVmdeHBrzaUWQyV+VDCziEwb:nCAki91GWMXkro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f9b2e3464b0fad589a3458443b34087a3ed1ef7f1dbad77645fbaafcaf2da684
MD5 619931f8920c83175cc8d9a67a052d61
SHA1 0bdccecf66becc95cd2f57ce84de4879ba43949b
SHA512 b68e42edf0032a5378bec97c503b967f9d690b67fdb389ef86de538fb5a83be04bffe854ebfb8052892d999ee94e09bd3ecec1a694c7f257983b01bd6b30513e
SSDEEP 96:nCAkoK1uUuwpvWMoiVmdeEuA1nGRpl2BrmaUWQyV+VD7AiEwb:nCAkv9uGWM0uAkpl27rg
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 1da800b8c9d34a544ad30ff48e22d5eb3a7d8d935d33513a2d11ef98e05f058c
MD5 53292dd4366782103a0f88a9e63b27b1
SHA1 c8c089c07fd205cd9a871bdc19a58cd9cb0f5ffe
SHA512 c259e0de7a3008a4967ca034e2e592aaaf83de98075e79a7bc370f2b41c9e203ed97ba7102d7ca72a4f192cc8eefbd74715a3aa28884daf6dfc66786ce62b830
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupwuH4e2RU7Mj2e3z2OMDCRn:A9iIxuERzA83h09RZxYTH2NyeaOMWRHH
MD5 SHA1 SHA512 SSDEEP

Submit Download