hxxps://github[.]com/BladeCracks/Slinky/releases

Analysis

max time kernel
70s
max time network
71s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 23:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/BladeCracks/Slinky/releases

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5980	NOTEPAD.EXE

Suspicious behavior: EnumeratesProcesses 34 IoCs

pid	Process
4672	msedge.exe
4672	msedge.exe
316	msedge.exe
316	msedge.exe
2772	identity_helper.exe
2772	identity_helper.exe
6116	msedge.exe
6116	msedge.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe
5224	slinkyloader.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe
316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 316 wrote to memory of 1608	316	msedge.exe	85
PID 316 wrote to memory of 1608	316	msedge.exe	85
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 3400	316	msedge.exe	86
PID 316 wrote to memory of 4672	316	msedge.exe	87
PID 316 wrote to memory of 4672	316	msedge.exe	87
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88
PID 316 wrote to memory of 1332	316	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/BladeCracks/Slinky/releases
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa50b46f8,0x7fffa50b4708,0x7fffa50b4718
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=3560 /prefetch:8
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2112,9734176967817143389,8393158794070190579,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1560

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5592

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\WatchTest.cmd" "
1⤵
PID:5712

C:\Windows\System32\NOTEPAD.EXE
"C:\Windows\System32\NOTEPAD.EXE" C:\Users\Admin\Downloads\WatchTest.cmd
1⤵
- Opens file in notepad (likely ransom note)
PID:5980

C:\Users\Admin\Desktop\slinkyloader.exe
"C:\Users\Admin\Desktop\slinkyloader.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
PID:5224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
c4d86e4b1d61ed304a9ec0d1835726bf

SHA1
ed1ff53e9298d3ebba445a390e3cf634218f830b

SHA256
f2e27511bd3810f694911da9f163f7afc673c11a25d83b52bb51310abf1a91d9

SHA512
28f814299050b177e8299abac1c3e84f1097899a32f081fa4cf1fd1041a290d423fafbf305932f8499f9635b9b8acbdd1245eb79e4524702cc41b845a6406393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
54bdfe86c51ff80a8e5d3e51ca27b30c

SHA1
5b4d00e41c41a5bfd5e6c3cf435abd40f2839b5b

SHA256
48d236f757ae6136f22ffb5272070e74beac32064fc5165c2cee1695eb715cf3

SHA512
62fe568562dffc10653b1fd825d1a6da8276ab5cca3fdb10389c9f3f951fc7aa6f533775822d77924daf85a879b4276b213ff2539dce24c1c362c045c8f2f36a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7f5175ffd5455d93ea860cb02ff21936

SHA1
e036dbf9f291942820c2b15fb802135424da2505

SHA256
1a2b836e6052d922c3394a1f33cf22aeeba6c96c432ebbf1f123557a6e203af8

SHA512
06c53858b4f69119579d6f775cda9bec236a68605fa1e94fb963f31ca59e0c791342329959172aa597a968ef1754f846e4f1deb88e78275746a00a6f3706e853

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f0b7afe74253abbb5bc34dc72fa5b921

SHA1
75c46301ebadc8ce52c7d83d4d1517978095ef4d

SHA256
033a9cd2747c6d2a951e1bf02bfa15c793964419c6057e4109eec87469f74a68

SHA512
d263c20b337f03a7e6c635136f04749dfac1e038b7054881d25b3f545317dd823308073a3cb34bc703731d750ba70300faaa9dea7012285b3a84eb06903a23b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
edc62bb5b3af0c725179ca9613c9a429

SHA1
d57dd26bc00dbb22bb22a001c5efdb9b51b7ce6c

SHA256
858dc81fc20ac6b9259ec471a385a2631215b957dec3398d5db08ce90495ca4b

SHA512
0b3fa23f70610281bd0f85a0f295dc0950f9ff0bfe91a35b9f83a7efa0971dc36c2c082b77bc489d49a9d7a87ecc2c835b05fa09184f43778c73c038285dd06a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cdc0.TMP

Filesize
874B

MD5
f1ed49cc1bd631e8aaee52522735db06

SHA1
94c3fec24d43f8908806b02cc563e12d0d7be3bd

SHA256
48e4e3aa260a3740b9e54c734afae3d82f210a25781268e2e4146b10d47385be

SHA512
e52764dc926eaf847098f23e9b6238d76d6fa483aae63cca38174c0c47e1c1bb9aad26f1ba14a1a39486db19795ab0bd5adfba51e84f399e8b926b57465005a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f9d9f61418aac4d2eac0e60cd6e6e9be

SHA1
9861481eaad57173104e39c01aecad6e32d5c0b5

SHA256
18bbf3219f10cc7ebffc2bf97185b63194f12eda8e5a2a1291e0026a5f84852f

SHA512
4d4bf30502dfc6e13984f2cd817022ab505420806fb08f61ca0b7c908bdee8c9e0e7d8decdb936d0623fbfe91b3975ef7f5bdfedba2cd3b5e76075a4c2654c45

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2a0354190060a82713ee3a90f9ca24d

SHA1
4c99851ed562b325b2a0c92f20b0090984f023e2

SHA256
3dd3bf2ae742f1cb95ff799ce25d71d46bad097b54c8eccfb56c694a955f36f3

SHA512
54cd462aafa8741096c4f94ea674003a68231e027d71cd0da3d8d8236189c06cadd71840dca241811e96936cfa23b3aa87a08be3780a7baae7768f82b7e6f477

Download Submit
C:\Users\Admin\Downloads\Unconfirmed 772894.crdownload

Filesize
17.4MB

MD5
efd88c8bb5f2cf4f992f8d9069cab941

SHA1
f395f08785ed4309df4619cc77ba10395ce851e1

SHA256
a964201b566632ce76139f1a34be92a4d9c8166546426d64a6b1795cf52669b6

SHA512
8ecc5a44c807cd4406eff3c2d9279b3239588b34472006488bcedb5932e370d1d44c29e5d60440a2e0a88a24c88e3c5c4c127c89fc9a469bd8b74b780596c5fe

Download Submit