hxxps://intralinks[.]us[.]com/lI1AsaoTxsullI1Avan2AP4DCttasz01w4GoTxvz01I1AQ3E

Analysis

max time kernel
312s
max time network
345s
platform
windows11-21h2_x64
resource
win11-20240729-en
resource tags

arch:x64arch:x86image:win11-20240729-enlocale:en-usos:windows11-21h2-x64system
submitted
30/07/2024, 12:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://intralinks.us.com/lI1AsaoTxsullI1Avan2AP4DCttasz01w4GoTxvz01I1AQ3E
Sample240730-plplnsshke

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft
Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
2132	msedge.exe
2132	msedge.exe
1480	msedge.exe
1480	msedge.exe
2660	identity_helper.exe
2660	identity_helper.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3976	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3976	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe
2132	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2132 wrote to memory of 4828	2132	msedge.exe	80
PID 2132 wrote to memory of 4828	2132	msedge.exe	80
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 4680	2132	msedge.exe	82
PID 2132 wrote to memory of 1256	2132	msedge.exe	83
PID 2132 wrote to memory of 1256	2132	msedge.exe	83
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84
PID 2132 wrote to memory of 3280	2132	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://intralinks.us.com/lI1AsaoTxsullI1Avan2AP4DCttasz01w4GoTxvz01I1AQ3E
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7fffe3303cb8,0x7fffe3303cc8,0x7fffe3303cd8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5092 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1736,5278432463579202711,17624191889291737260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4552 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2580

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x00000000000004EC 0x00000000000004C8
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3976

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 6a3f99064360d7e9c65236f857f07213c458ed2ea666ad7948aa514e0af20977
MD5 2080186d6f5db7e3cfa005821bfbb7b7
SHA1 747402499c74c1303864628ab62ad7b9f8cbb593
SHA512 1e9ed1b8a799aedd5b460c78822811ae93098f6da012ae89484210c38bf56c4e8bd7a8a8980ab663556d9993e7a49f94617821302a7790df85aef017c7636dfd
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 09dbac8e0cb7d1cfd7b23332aff14ae4adc2602004fc3455ba40ee461fae43ae
MD5 0b2946bd56a8142b51e97acf601cec62
SHA1 352e245063c513cdfc8e0b32c88157b23d7c3042
SHA512 4fd2b0e7f9e1281548093791b0540277472bd71394f9255df4e7fa5cb6a2609d501e604e9cc5a88fcd8749540292f5074a16fa2ef851b5d06a7a661474bc9511
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 168B
SHA256 9348839ab22068679916600838c52a47e189977c82cb6f5d717fb77be609241a
MD5 5184b9eb8faeaa334654260958fa2b4c
SHA1 619f7f540974f03082a235d8f21da89469382704
SHA512 7c1f5a306e68dd237abb68f4929dc3ecc1fedfdb5c52d693d1a5cb4458478a7ce8894efb90aa8ba3d5b8d60da2f99abb47286f0d90ceaee24798feaf0b4556ec
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 648B
SHA256 93448de15b71a922084d8804751d21fc74a54dab5ea80eb511996d4c2b3c6238
MD5 d79486b68760633b8878cef1e91ef3db
SHA1 2ab7de781599d2da182b378f8d0409db4559df40
SHA512 db6170848acdaa6395e06a442f1fb67c1225241ca28c96868efb2548fc2949b957db5076e9a58debed7c3aa04384510046398955db6b9901b87fb94febbd2286
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 648B
SHA256 0acfbfa15ba55555e195d968c34cf359f736b837fc5fd36e992deeac66fb8e6e
MD5 fca810b7ba48dfe2a4055751941483a3
SHA1 90ab4235090138d654dcad150fb5c0638d5b6035
SHA512 cd6d2faf5a5de4fe3e20f8148438203dbe29ab2d5f0ffcb448f17e8c3329110f373d9a4bd27372a7992f7af2175c0e9e29ae5c88a088b9c716841975ff3fb84c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 75cae2be0a6816f85e45dabc276f557bfcc0c1b002034cfe1d7929b79de40572
MD5 35b87519b957d956ca065cfcb0bd34c0
SHA1 ffc578b8823a6c4333a541d1edba67b40ecb6b6c
SHA512 711dd584358f03e1b232d50c861e65e708bb39a5575932d78d308200f1ebecf4b3bb7af514016e6d8db1e726739c9967ead8fe2b0aa8875a22e41cd0c0d98e63
SSDEEP 96:n9k3YtikDwZwSv0MoiVmdHIUJXR0WQyV+VuziX3wI3:n9k3+ikMZv0MAIyXRLM93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 61aef08408966e95825e8f7289c30d22455955593a5dbdf20f10c6938420a199
MD5 cfc4d66b5f07f166212b4eb3faaf6144
SHA1 4c61e1f020291ff4c4cc5fd40a001f6dbb9a5ee7
SHA512 250d244878fa3121a4eeaf23d16c51b0bbf1df7a4b7eabc6b0688261b9ac239391748e692ce09cd5e5eb52f81e6f594056d79cf51c064aa4a802de2b77e135a7
SSDEEP 96:n9k3ctikDwZwSv0Moi5dPR5mdRdOui1jI6ZJXR0WQyV+VpAiX3wI3:n9k36ikMZv0M3juihIsXRLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 6dddb50c0343d4c03d2477f617daad74d23bf16c9f758b0967e23166745cff97
MD5 a5d6bdf4ce6113896f4366ce4bc3d00e
SHA1 bfd8796cbe98005a08e0b3c29ab7c13b75d74612
SHA512 3c2fca2d58bc69e050c934af51f95086d5c4b37e025756c9c2d501778a50a4248a272fce85cfb519effdc24b7a977692b2891a94f316b991ee1cc11f80c365b5
SSDEEP 96:n9k3JtikDwZwSv0Moi5dPR5mdRdOui1jIlJXR0WQyV+VpAiX3wI3:n9k3XikMZv0M3juihIfXRLe93
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 95436a2f6ec28440bf990220c1ad01447889fefadf57f10b04084888979e65af
MD5 951c623eb0af24938f75d085e98975fc
SHA1 618e65e102dd24a59fbd6502dafc86e91822f70c
SHA512 4dcfe0937f42c48be04e7ec45420667e89562c54ee69858282cf92e244edf3fc3c0b95deb49a1718fe9b585b652b8586b2c0de6a7f0af54d8c01c3a900e70248
SSDEEP 192:coCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxASGy3/sRe2RUssR5FwFPehMWbrk:M9iIxuERzA83h09RZxASGGkF1IOFPehE
MD5 SHA1 SHA512 SSDEEP

Submit Download