hxxps://5481[.]mlchpt[.]workers[.]dev/?pyp_argid

Resubmissions

13/06/2024, 12:40

240613-pwe5zsygnf6

13/06/2024, 11:38

240613-nr75ja1dpr6

Analysis

max time kernel
134s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
13/06/2024, 11:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://5481.mlchpt.workers.dev/?pyp_argid
Sample240613-nr75ja1dpr

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	ipinfo.io
18	ipinfo.io

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
656	msedge.exe
656	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
3036	identity_helper.exe
3036	identity_helper.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe
2704	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of FindShellTrayWindow 27 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of SendNotifyMessage 26 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1888	2312	msedge.exe	82
PID 2312 wrote to memory of 1888	2312	msedge.exe	82
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 3196	2312	msedge.exe	83
PID 2312 wrote to memory of 656	2312	msedge.exe	84
PID 2312 wrote to memory of 656	2312	msedge.exe	84
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85
PID 2312 wrote to memory of 1784	2312	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://5481.mlchpt.workers.dev/?pyp_argid
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabdd646f8,0x7ffabdd64708,0x7ffabdd64718
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,13389416267286856734,4567143992418775136,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201
MD5 dabfafd78687947a9de64dd5b776d25f
SHA1 16084c74980dbad713f9d332091985808b436dea
SHA512 dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c
MD5 c39b3aa574c0c938c80eb263bb450311
SHA1 f4d11275b63f4f906be7a55ec6ca050c62c18c88
SHA512 eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 eb2bca8afa75903e76c15d8a76d37a35b7c5f05565dff3cc670c98ecc3a95708
MD5 4644413eef60c88197a91bb67ca57c04
SHA1 ca4ab7ebf30e474dfda49143c090a54daa844a32
SHA512 edd21da29aa90f2cb3f6a2c8db9d5eaae350e3057a49084925f5db9be2db0ee5ccb79be63ed763fe5820e6471104e025e1b8f5f1432b2f909c882013aa12737b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 e73b3822981228fd3c49cb6a4410eb7ca130e61c4ede0c4218799d1ab53c1ae6
MD5 5a13ded9d4ecf15076791a2220b4ff61
SHA1 c72eccce24175c967582899a83f1409aa3bee8b4
SHA512 2726da5232a55d7185f8646ae1528b2e41584b416fe5cf86e8852c76b703ebe2460a36ee78d82ba7fc553389622109273b4cf2fb44879056572ecdaaa23718d9
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 2KB
SHA256 e7d5fea0cd39f51083919771dadab17c677d7c61d34c6127049dd052029d4fe7
MD5 c9b7d942d2eedd551053356d263be044
SHA1 0edd4f93a86c6dcbe4f8f3f2ed43abf13792efd9
SHA512 c76f3ab88a3f39d761ca3356de61f089d0fc17d49c0dbf54efb2d341c629b16dbefac2900c8580c1656e5566476c33058e51cc3fa10788e82d6ee74e614e5da7
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 8ebf68cd8f0e6ee4bbaba5e42fa6681b36119f088e7e0a876798baef9963b144
MD5 2c31a82abfac219c09b7150aca029d52
SHA1 b4427a6078c05d776af37e07ed2e1ef6cfe45b5a
SHA512 7453c640896089b47de0e1d3beff66f0c6e135d199eaec665f8578ae9c665dfdbe7ec4bc9e72d2d60cd2406faa8336bc4681c3d2a6728573e39dc3f95935679a
SSDEEP 96:nwSk/oxm/DamqAF17Q6mwpvWMoiVmden3KuG1HzL21UHFVpgUWQyV+VDCAiEwb:nwSkBdBFBQ6mGWM33KuGFzL2m7pgrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 835b9ed1605f3252b9830a8fbd40d4035c276ff59cea29490f763f6668492d70
MD5 61fac54d8b59ad497d25ae575e27c890
SHA1 d1c7eb8122a9c5c34c768286870fafe5832c03f0
SHA512 659eddfa23767bfab9643886282ce8e58a6749ef536b46689f4f208782e8e8b77889d97ec174fba175b00adb46d8855d51a7a23c7be7c609edc16c56f7a870e0
SSDEEP 96:nwSk/oxm/DQYmqAF17QCmwpvWMoiVmdeH1DVpgUWQyV+VDCziEwb:nwSkBIBFBQCmGWMXzpgro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 f33f066fed26580523d8420262d83e386c03db2348a04594085751e9c3868c23
MD5 71a0ef12abceebc12c0c8888658e6338
SHA1 05049d383e756b33e16d6acd7ace17ab24d2e8b4
SHA512 b1eb4dbf9d8579063238411b0207d49e2b454feacd2ec5c86fb23c1fa26dd8d2e297a269dbd34a2f1bf07a69c496316e30772c1e16243635fe32c241ebd888b2
SSDEEP 96:nwSk8sQpoxm/DamqAF17Q6mwpvWMoiVmden3KuG1HzL21UHFVpgUWQyV+VD7AiEc:nwSk4dBFBQ6mGWM33KuGFzL2m7pgrg
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 1KB
SHA256 c89d00704abfa929da850d4b75ca01ef8635978287ad0418548629806a5f3949
MD5 e4f530f91bff437ab1b1e34a9127250a
SHA1 9ad661007eb0cf4f905f1b80366abcb93acc8500
SHA512 595b7dd5402df48ad8c58887d928ae6a27eb7a93671fbb42b1f1b262dc7091873cec62d36bf9a5e0638e39b04bccee473440bf64305778603a660776af9457c2
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe57c081.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c081.TMP
Size 1KB
SHA256 3674ceff5d992222d310d4435605e3c22f43475e7d3ea31dcb07bb148b002f8f
MD5 48b048473691ee866c7042b3f3b58b76
SHA1 a6149dedc4089c6c53c8c63c8b7f0af1f68431ca
SHA512 fc25b89c160e64efc807fad53566a4f1dff0c5772490c2b7c821a620d1767a2973a462279ed447ec5738da1db716b1b96bfc3b36d6f551dd84cab7f343e17167
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b1e6880ecd46b98a8053582d22bced071bd231cd603a6b02d5d06ffd9d85d1f4
MD5 edcc22a4fd885f1710ab16579abc5e13
SHA1 2a4732c995afb5b513450924e698d0d6f93e7af8
SHA512 183d1ffe5316f5f58648a48c0a151f21184c0b599eb57e4b761af0cb7d76312e0ad3c01e4dbd0b155ab84f145dcba166b465bd680ffcd27c40d0ba36527afe52
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupvYXNe2RUmC0SRsRt3z2OMY:A9iIxuERzA83h09RZxYYJjCbGRtaOMW1
MD5 SHA1 SHA512 SSDEEP

Submit Download