hxxps://www[.]piworld[.]com[.]com/

Resubmissions

21/09/2023, 17:00

230921-vhzkcsbe34 1

21/09/2023, 16:59

230921-vhcqlahd8y 1

Analysis

max time kernel
150s
max time network
155s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2023, 17:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://www.piworld.com.com/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
460	msedge.exe
460	msedge.exe
848	identity_helper.exe
848	identity_helper.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe
1976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe
460	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 460 wrote to memory of 4944	460	msedge.exe	84
PID 460 wrote to memory of 4944	460	msedge.exe	84
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 3280	460	msedge.exe	86
PID 460 wrote to memory of 2704	460	msedge.exe	85
PID 460 wrote to memory of 2704	460	msedge.exe	85
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87
PID 460 wrote to memory of 1280	460	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.piworld.com.com/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafa9b46f8,0x7ffafa9b4708,0x7ffafa9b4718
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2340 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3780 /prefetch:1
  2⤵
  PID:492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,6505034512641190828,7291555305516526014,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2884

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1222f8c867acd00b1fc43a44dacce158

SHA1
586ba251caf62b5012a03db9ba3a70890fc5af01

SHA256
1e451cb9ffe74fbd34091a1b8d0ab2158497c19047b3416d89e55f498aae264a

SHA512
ef3f2fc1cedfc28fb530c710219b8e9eb833a2f344b91d3ffb2d82d7bbedbc223f4b60a38bea35b72eb706e4880ffcbb9256a9768f39bae95c5544be0f503916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
366b367016b0bdf057bc7bce1cfb4478

SHA1
23da83db50f0bb53f76a42c42a413f8cdf5696f3

SHA256
63d14d0ab6dd7867b609f7c4f0afc594960e535c8f1f3655cfbfbda93ea3f44b

SHA512
a884281ea92efdf08a7ff134b4a4bbc7f049bf44d5eecb803e969d5fb9e7ff580ebd226a9a832980e546f52e665e18f3eaa47a3c13e5dfa60d3a8a3a358b9d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8c6abad7838ebf757d8d6a71ba8321d7

SHA1
0e644c9fec35a27ff2a0638c172b1d95e265fbd4

SHA256
ec9fad442025e666bf63e2ce04c46617563e2188da2ecd0451dd383ec08eb8f8

SHA512
b70e3b2060bc35fe3306e8e5d7695542f0228e3ee4dfbf391625e060834a29b2d54c11e56780ff33d068265ba4c94787b683a49ae1b024eefbce8672d21fe284

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d3de7e9377f68fff1892439884739da3

SHA1
c238dec1078d62f03a03fbf7cff126be4a63fdd3

SHA256
c759e5684a8e3e9f358e246d0df1a9db76a23b447a53c9b698469c897e93b547

SHA512
7f4a3b9f1746343365341a00ecfd50321a57acaeae53b50ceeb75dc07340c906630fc277958902f3a206ff99dfeca00a20146bd0f8eb7fe9a3f96e0ec9823346

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
849fea343e023211e60280431814ad6e

SHA1
00896b46ac6882eb64ece57bd2c2b4390d4472f2

SHA256
f0064e398772219af419eeab8a14d63fde0797bc6725d0e51f6e3d36c181e56a

SHA512
9996bc57c8dc26c7da54e1868a3bb37fe5100b695c948e47f642179f115ecad2c7e312d9d4bbfc4e3c200ea556a4a3c893e83aabce09b4f170f912d07f2c0df4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3668a5ca69d90afeb3a09945a00a0fad

SHA1
5a05b52ad6999ea451b1799126159d8ffd9d52b4

SHA256
3c3a1c4666a16874b0c713f0789781217c095b94ce65027b57afb59d6546468f

SHA512
24740c75243ee35145d1b9513cc779d8a4d17c58c15a121cf5de190ce2bca98f58557cd8b37b263e6e95d3c3e96e3bd564aba393c399b038aae41e20bb15f6ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
15ad31a14e9a92d2937174141e80c28d

SHA1
b09e8d44c07123754008ba2f9ff4b8d4e332d4e5

SHA256
bf983e704839ef295b4c957f1adeee146aaf58f2dbf5b1e2d4b709cec65eccde

SHA512
ec744a79ccbfca52357d4f0212e7afd26bc93efd566dd5d861bf0671069ba5cb7e84069e0ea091c73dee57e9de9bb412fb68852281ae9bd84c11a871f5362296

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
af1e487cf7be25b355f0cb04df731629

SHA1
0fb41d26b861700191ac645a022c3cda529aa672

SHA256
1a932bc579f1d9fddf9f1df0037252db80a439da2f1ff89e310c18b10459f581

SHA512
7d9144e745bb91d8f1ddbcfa86f358cba9604dbe96691f538e0c677f8f1e8d0fb9c0e60eaf674ce9933ac1c37bcd277048584cb8be86885139f643b17e6979d5

Download Submit