hxxp://www[.]australiansteel[.]com[.]au/

Resubmissions

12/08/2024, 00:08

240812-afbejawbml3

12/08/2024, 00:05

240812-adpjdazflh3

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12/08/2024, 00:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.australiansteel.com.au/
Sample240812-afbejawbml

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
720	msedge.exe
720	msedge.exe
960	identity_helper.exe
960	identity_helper.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe
3092	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe
720	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 720 wrote to memory of 4116	720	msedge.exe	85
PID 720 wrote to memory of 4116	720	msedge.exe	85
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 4928	720	msedge.exe	86
PID 720 wrote to memory of 1984	720	msedge.exe	87
PID 720 wrote to memory of 1984	720	msedge.exe	87
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88
PID 720 wrote to memory of 4588	720	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.australiansteel.com.au/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd15f846f8,0x7ffd15f84708,0x7ffd15f84718
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1984 /prefetch:2
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2344 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3784 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5592 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,4377406000729296685,5554697935987264349,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1916 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3092

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1272

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x508 0x524
1⤵
PID:5080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c
MD5 ff63763eedb406987ced076e36ec9acf
SHA1 16365aa97cd1a115412f8ae436d5d4e9be5f7b5d
SHA512 ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5
MD5 2783c40400a8912a79cfd383da731086
SHA1 001a131fe399c30973089e18358818090ca81789
SHA512 b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 264B
SHA256 dff4a7ca82ec8671fa2096fe0ce6a99faace1c76faec9c0257abeb6f2fb8cab9
MD5 7b732a9f076663abdaf9170a4be4f8ee
SHA1 7f12f63a425cecff4fa5cf14770f99df48445077
SHA512 50a447198b250eb079c0e25f2ded7581e67573c9b51e7b2beed93ff0010a6fd90a328eb1e2c8fba8b53b98ceebc99e8de81a5190b968dbde9deecc30739e0501
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 ad0d86488db0d6e0794f1571bb96f0c65d14c12e6357cf2402046c397b8eec62
MD5 68a48219a3055e3064b9dee20ca031c2
SHA1 36dbdfde3cc4046ba243ce90437c775549d7b264
SHA512 6b2cc04ccd10dfbee36226988cf954f6b642a002b40d3d9a914ca9bacb832c9005b3d07fc6668a5e17b771e040b38e2aeaf0ed586118750a564f63931a051b40
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 75278eea18500786482eb910b97ff45f5a6aa360a0d9958b96bcab86c1125b9b
MD5 f310fa09619f424401096295bd669e7a
SHA1 e544b1de6f5817c270eb8088317def25e76191fa
SHA512 72addb8e5639cbe45e5c99b8cb344c03b6726d3af66415caafd1369289414d56264faeee6a4295c50276960c8684afe6571202fe4762fe730d299be2e62701b0
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 bff4a8fac63d173453ecc22d1017d43add208cc578c9fa45a8638ee2f628ffb9
MD5 ff79b9f8bcdf68fbd3b28377009e0e28
SHA1 d53ab739451cc899f6cf24cb735c390e1f703a42
SHA512 8664a0890c87ac2736918246f42e5b73f6765ecabd57f8700b14397ea80716b0410161ff34e8658b8c815a59c2507ace9b7eee1c67fe92193e41f89f70d5bd03
SSDEEP 96:nZkzDxm/L6mqH1Mqk04wpvWMoiVmde0guP1nGUoGXqa0/6SUWQyV+VDCAiEwb:nZkzwNMvb4GWMDuPZBqVySrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 0b5986297709687d61b8557c112b723dcf6ef97b073fa64eaa6757280798e2d7
MD5 07af2f6c7d5855e1cbe18c7971282c61
SHA1 f6179e4d01437cebedcbec8f11075f40639052e9
SHA512 5381257c6ca042323268387cd0c72b0256e87d41454fd6c29a8d8ea9f73fb80bc4cfa74ba9c7f191ae3e30b8b83e54ff1277c11d619676ad9bf023d7b4218292
SSDEEP 96:nZkzDxm/LQYmqH1Mq004wpvWMoiVmdeHa006SUWQyV+VDCziEwb:nZkzwAMvr4GWMXV1Sro
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 0d73f655a8206c1603d3c43ccacdb8b43ef001a06697012bd749d365925ae272
MD5 d4104a838b6b1b398003862fffb144eb
SHA1 67a3ebb192533801aaeaa20775781bd624aa48a1
SHA512 2696c29207ba2c642df1b09c01cb3161d08eaf8d411f54095c3443753fc1e40dd82945642035c66088a18414d28cd22da76f5e2bb769f9efe59b7df2e91fb3fc
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupS1e2RUm9AHru8z8ZJdyJ/:A9iIxuERzA83h09RZxYW+HPz81yJ/
MD5 SHA1 SHA512 SSDEEP

Submit Download