hxxps://t5[.]emails[.]virginatlantic[.]com/r/?id=h1156f0e5,23add98e,23ade7cf&p1=dashboard[.]ciux[.]org/?cO0iW2=jht&2h!1xlGpGV/5R_J8NUm8cAfZnJhbmNpc2Nvai5yb2RyaWd1ZXpAY2FtcG9mcmlvZmcuY29t

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
03/06/2024, 11:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://t5.emails.virginatlantic.com/r/?id=h1156f0e5,23add98e,23ade7cf&p1=dashboard.ciux.org/?cO0iW2=jht&2h!1xlGpGV/5R_J8NUm8cAfZnJhbmNpc2Nvai5yb2RyaWd1ZXpAY2FtcG9mcmlvZmcuY29t
Sample240603-nz8e9sde21

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
452	msedge.exe
452	msedge.exe
3572	msedge.exe
3572	msedge.exe
4244	msedge.exe
4244	msedge.exe
1944	identity_helper.exe
1944	identity_helper.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe
1148	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe
3572	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3572 wrote to memory of 1264	3572	msedge.exe	80
PID 3572 wrote to memory of 1264	3572	msedge.exe	80
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 4488	3572	msedge.exe	81
PID 3572 wrote to memory of 452	3572	msedge.exe	82
PID 3572 wrote to memory of 452	3572	msedge.exe	82
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83
PID 3572 wrote to memory of 2412	3572	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://t5.emails.virginatlantic.com/r/?id=h1156f0e5,23add98e,23ade7cf&p1=dashboard.ciux.org/?cO0iW2=jht&2h!1xlGpGV/5R_J8NUm8cAfZnJhbmNpc2Nvai5yb2RyaWd1ZXpAY2FtcG9mcmlvZmcuY29t
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffef8683cb8,0x7ffef8683cc8,0x7ffef8683cd8
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1972 /prefetch:2
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2020 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5236 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4964 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1960,9032560056568851886,17085019333775667166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=3672 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 296db8c9361efb62e23be1935fd172cfe9fbcd89a424f34f347ec3cc5ca5afad
MD5 a8e4bf11ed97b6b312e938ca216cf30e
SHA1 ff6b0b475e552dc08a2c81c9eb9230821d3c8290
SHA512 ce1a05df2619af419ed3058dcbd7254c7159d333356d9f1d5e2591c19e17ab0ac9b6d3e625e36246ad187256bee75b7011370220ef127c4f1171879014d0dd76
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 03dbdb03799f9e37c38f6d9d498ad09f7f0f9901430ff69d95aa26cae87504d3
MD5 23da8c216a7633c78c347cc80603cd99
SHA1 a378873c9d3484e0c57c1cb6c6895f34fee0ea61
SHA512 d34ae684e8462e3f2aba2260f2649dee01b4e2138b50283513c8c19c47faf039701854e1a9cbf21d7a20c28a6306f953b58ffb9144ead067f5f73650a759ff17
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 bb1e6aa68360b15a81e20eb7e9d19ed1ae190b1f9ba4414e1c6adebd8f978ce9
MD5 3b848709e0f01aa7d42becfdec0312e3
SHA1 392b807d57b43708abca37d487eb5e4fd225da45
SHA512 b0bb596cc9374d894002ceae294a1fd7141ef7c3e514e8f221a03e6be0f036e74ff973b051639573b04c80a95ecb681bb76b40435a5c1f28b26183ddd197cfa4
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 af5812f79134ae39943363f4c00542e01a7bc50d2f9605e03c884013f55a4da1
MD5 ebf0235e0f03f2d3c6aa85826d605d35
SHA1 3e23aad186c216d93e650610e4515835388c5584
SHA512 e8613f9b58c4a5aeb575008dc941cc785bb4caf2b04dc9d72b44327921dd0d5968ad303a633d1dd13ed4736206bb1cc11750cd628e596454425e9fe8e1339365
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 b2dd48f2a50a5258727290d4faea3b9c1bdc3b97478149793e85cb8434cb7c82
MD5 24eec64d041c18674eefbfd6739a8993
SHA1 e7c516173f48ec49f15356db8793972aed1abaf3
SHA512 fb9ef3bdd07358550b26a85191055fe6903efa6debb59a250d8beec229a65ae7eb0e31e3f3584c58abf59569fb60fb53744fecf67c540cf25617656ce00d1267
SSDEEP 96:nU6k3UkWcNkny7wSv0MoiVmdHIEJZd0WQyV+VuziX3wI3:nrk3qcNk2v0MAICZdLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 a1c3d14a9f7606359033087d12b13b8882e632bb4108c384566d7a0b5ad0bd5e
MD5 a4b2780e13aec2d126bf12218225e7c6
SHA1 b7472f1b3058dfb3ffd233cb85bcd9a2e7d7742b
SHA512 8567f5068464edbde3000d43436068aad1657fb49b760b8d22824178091868c4a3e3bf5ca154035ece5076e7613392500d5b4cc29bbfc4a0c3cde903e7ea53f6
SSDEEP 96:nU6k3JkWcNkny7wSv0MoiuR5md+vuEW1jI78JZd0WQyV+VuAiX3wI3:nrk3HcNk2v0Mu7uhhIGZdLH93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 3b716fde277fa0307c4cf4b08c0a4af4881e6f1b066f6bec323d2dbfaed3fce2
MD5 6276ec5eb5fc8388469e25c997d6e471
SHA1 4b37b741ae57357a16dd6d69c0926f79397900bb
SHA512 ff7de714c2a297816225e73ddd3662c082c297b335bdb4446d667514d51e9a85b8ce2c78b9e9b891ba614862cac77147f9cd5c0cf3f6f8736de1218a32e903d1
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxA31Re2RUFKRhND7YvmljEW5jD5k:M9iIxuERzA83h09RZxA3ng2ND7Yk9rbk
MD5 SHA1 SHA512 SSDEEP

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 07d60d3723e7c457fd69843d8a049a8a3f67290980c4afb372714fc186ab8aa7
MD5 e6356dc9e02022761a00d83193938098
SHA1 e6f3ae4032d7c237fb3583904afa8ab110aa756e
SHA512 00334694b038e57ec6afbd08add84798667897d03e23d65c8f1838d93fad2ade0d53a14ed3b5b433643de76b0daa0c1bcfd3ca76e9690df474e1fb86ef55d748
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGtRe2RUFKRhQi7YvmljEW5jD+:M9iIxuERzA83h09RZxASG/g2Qi7Yk9ro
MD5 SHA1 SHA512 SSDEEP

Submit Download