77bb35807e4fa5ccde415bfaa04496fa64e69e0c8a08163a37f3ba77af5f97a2

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
19/10/2024, 12:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
mirserver/Mir200/更多版本下载Www.Uc955.Com.html
Size 371B
Sample241019-pvbq6swdrf
SHA256 11664ed54c8667da47b0e914a4630b8f003b7c583245aee9e1dacb0e4d42cecd
MD5 d726adaaf77a5393dd5a4e76daed3df6
SHA1 6a591c992a00b4b77950c47fb22a52dcdf9efd0f
SHA512 befa984ae9b8d743f37dff638472afb9a3acc54d518cca3cbfdb162dedf2bf537f469cf3073d56105582a35426ac3aba8e0797e883802e6a4b946bba132eed11
MD5 SHA1 SHA512

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2056	msedge.exe
2056	msedge.exe
1632	msedge.exe
1632	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
424	identity_helper.exe
424	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe
1632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 3040	1632	msedge.exe	85
PID 1632 wrote to memory of 3040	1632	msedge.exe	85
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 4712	1632	msedge.exe	86
PID 1632 wrote to memory of 2056	1632	msedge.exe	87
PID 1632 wrote to memory of 2056	1632	msedge.exe	87
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88
PID 1632 wrote to memory of 3492	1632	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\mirserver\Mir200\更多版本下载Www.Uc955.Com.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9dbe646f8,0x7ff9dbe64708,0x7ff9dbe64718
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2672 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4016 /prefetch:1
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4536 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1376 /prefetch:8
  2⤵
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1376 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2212,15573617523032459767,8926401032045902035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32
MD5 6960857d16aadfa79d36df8ebbf0e423
SHA1 e1db43bd478274366621a8c6497e270d46c6ed4f
SHA512 6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841
MD5 f426165d1e5f7df1b7a3758c306cd4ae
SHA1 59ef728fbbb5c4197600f61daec48556fec651c1
SHA512 8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 240B
SHA256 dc7d8949274c543ad665e269ac0212b9485daff7807c39ce31fe5a5c76544659
MD5 ff8f9b79a20036579d0354ac26513182
SHA1 d23b7c78b1c1aba50ddbf4833ac1485b7de5f5d3
SHA512 1e7c8fdcb5d145274e6c72fe9265b164b69e1a4dffdfa0b7f8ce4a9d778f22d36081750c4d8bd13b2c74d36c6e1522baadaf2e548bce6d1d538fa31bc5e0935a
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 216B
SHA256 45f64152a053d6e997811a33e0d94db5fbaf3684cc2c7a6b754584d5923a8213
MD5 644a722f39976e0bd4fc280741b6b07d
SHA1 e6f713376efef4c14a039e3f80b18c1327063585
SHA512 f3f742ed079c13d9c82d58a2745dd7ac6f32e5fe6911560ea5a95860687a6b36d9927484c27a3ce6b909730322b00204075d27499db3724eb3ffaa902fa8eea0
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 e4db467077d2da9fada2ffed524c0670e683c046d7bbc480c1b09cbceb26bfdf
MD5 8da9a1264dfbec20cd6f6903d8b31556
SHA1 8d3bb61e516e237aa5c6680ef07ae7fa907229b1
SHA512 5961102bd28397c7a1834b49594dca9fb3e9d5355f1061d178ad3a03a86af75ba839647e5dc9fb117a61d2d33e41064ef9596afc69116e6348d05bd50fb98640
SSDEEP 96:nCkie1qd1SnwpvWMoiVmdeHdwNFUWQyV+VDCziEwb:nCkhQ3aGWMXYro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 56920040a9cfef873b95fb7240212c2f662aa3dc88a3040ea2eec92293b3c22c
MD5 36baa39f56873e9a901a5ed29dd091e2
SHA1 2e9536fde98ee3e3dfeb970960ac6a274c359d37
SHA512 bbde3462a7c3ced6d0d07200debdb9af93bb3ccf86073bf248b50059c647cb1890ef149a9ed65223b450f7fcdd5cd92ddbc99fc0743c45f37001d68c19420909
SSDEEP 96:nCkMe1qk1SnwpvWMoiVmdeHdwNFUWQyV+VDCAiEwb:nCkDQuaGWMXYrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 cfdd67ea05051add3c7f0e521928619b0dfd65f52ffa0494cc155a6bc321a743
MD5 4941d0b1effe58348648a31b61cda65f
SHA1 5e240582764e5b310cf8f214dab3a8cf80af4ec2
SHA512 f062cb088f3d6cd109e45b8cee7e634173a6d60e4a13723ba2014e6d78777416c8ee4c8e7a2e6e4c9234eddf3752121e11d03dc3eac3182708e0dfbf60a71d90
SSDEEP 96:nCkMe1qd1SnwpvWMoiVmdeHdwNFUWQyV+VDCAiEwb:nCkDQ3aGWMXYrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd
MD5 6752a1d65b201c13b62ea44016eb221f
SHA1 58ecf154d01a62233ed7fb494ace3c3d4ffce08b
SHA512 9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 4ecb0681ad83a3083cfaacf15f2851b3a7823990c44a2e41d82a4fd05451c6f0
MD5 7579f29fbd724e1913f8a6aeffc8da50
SHA1 37066f8bd3d80579283905916652909418836b70
SHA512 61fac36228ebb5e47b3e33290b65cc73832afe3eefdb14e5d7e9334c279130a63e9a237b75d02648bc886dd0c3b4109cc9b183c19bc6de493fb3a3647370e0f6
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupl2Ne2RU9/RH71K3w8Vsu:A9iIxuERzA83h09RZxYoKNBK5su
MD5 SHA1 SHA512 SSDEEP

Submit Download