hxxp://www[.]ftc[.]gov/Fortnite

Analysis

max time kernel
88s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20230915-en
resource tags

arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
submitted
15/10/2023, 19:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://www.ftc.gov/Fortnite

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1832	msedge.exe
1832	msedge.exe
4352	msedge.exe
4352	msedge.exe
1276	identity_helper.exe
1276	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 640	4352	msedge.exe	82
PID 4352 wrote to memory of 640	4352	msedge.exe	82
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 4912	4352	msedge.exe	85
PID 4352 wrote to memory of 1832	4352	msedge.exe	83
PID 4352 wrote to memory of 1832	4352	msedge.exe	83
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84
PID 4352 wrote to memory of 60	4352	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.ftc.gov/Fortnite
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xd8,0xdc,0x7ff9bcb546f8,0x7ff9bcb54708,0x7ff9bcb54718
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6320 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:3720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,16763453720926185210,12888534184951497686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6480 /prefetch:1
  2⤵
  PID:3872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4532

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
16c2a9f4b2e1386aab0e353614a63f0d

SHA1
6edd3be593b653857e579cbd3db7aa7e1df3e30f

SHA256
0f7c58a653ae1f3999627721bad03793edc1e9d12e8f5253c30b61b8478f5c81

SHA512
aba1ed22c7b9ae1942d69a7cd7a618597300ae5c56be88187ddec6227df056f81c1d9217778d87fa8c36402bce7275d707118ff62d3a241297738da434556e06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
39f33830427c889ba3ebe705d93326a9

SHA1
4f7fec732548834a23fcca75998863e3382f2eb2

SHA256
d7752379d2b6c69c5be7e43570dc12b138ef01fe11788ff96703c2c97436dcde

SHA512
2f0922548e6d146d87f9f1a5f623ad0413f2846b08e994dd1ee5587bd18545657a477d282067166b43d629582ee5f9537309a0dbe871a2949e4952479b197da6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
483092bcb6281dde79cf755e0df2865d

SHA1
61a0561cff85f069fbea47030d76af8b132e0535

SHA256
ae31965bad915172b1d00ea1a2b555701df9b3aee86f8be85b8d2cb87dc1d47c

SHA512
47a2c67c555939973a96cff96a6c8a42810041aef1099ae23359fd86dbacd4a781929d72727f3a234f2c83999a690f7d728808790ab5a895edef03bfb54097c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
aa72348e638c6de03002f202b5c20830

SHA1
30663a25859783a421d29eb361f3d277584a982c

SHA256
1af1bff64709fcc5949412dadcfe95a06390a67655b747040ffe28ddc9546162

SHA512
24546bd9025f14cc5f189632946d25c46a783e27cef9f82e1e642ccfcf2d60c419657a435ba9f6d788d5e3f2cea3ec12d301ed87298f3886cece4fcc3d980381

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a831d63d3247502a22837ddeb1972a96

SHA1
c0e02d4dd27bc11cd6430bc156a9bfb63e8db742

SHA256
6fbe9eee2ff6ef170c1fa6403e3672cc72c83c741bf5b8d7e4877b37beccce58

SHA512
61c9a95a2f3636ce307df9450d41c991e0bea8a14b38e6a01121a97f9b8e50fe3eb5139185b334d0ea5955f953fae5e092faeb4568c403c48fa0ff589681b976

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d43955a03d753561dee404198a5fde01

SHA1
46bb9db7f45f3516924cfcfa9d41973feeae90e2

SHA256
90d7850a4da76c21ead857af00616936a72a75a6c600f14a02f70ac725c41c5c

SHA512
34f8a50b88055662d61c15b1f2df79d6bd4aed2581f8f2067d4a43baba87c13205c14118a894a7379c8aecf6dbfb04d920ae06eb30a543ae2cde05efad935752

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7528abf6b6cb6f5e2cba614082b7a2b7

SHA1
ab522513fad585b4f9a582729e8d7114e69e9287

SHA256
0abe4901a9b000cf27254ddc6e9ff6706a948eb8190883e34b8bedc11a5bf261

SHA512
4dd7a045720d53d3c5b59024c72182beadb13651254c5912467ced31e46ddd3e1bd3277ecb6444103ca1c86168b9f84e01f37ca94dc3d842b88c1a120d3a72b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
699e3636ed7444d9b47772e4446ccfc1

SHA1
db0459ca6ceeea2e87e0023a6b7ee06aeed6fded

SHA256
9205233792628ecf0d174de470b2986abf3adfed702330dc54c4a76c9477949a

SHA512
d5d4c08b6aec0f3e3506e725decc1bdf0b2e2fb50703c36d568c1ea3c3ab70720f5aec9d49ad824505731eb64db399768037c9f1be655779ed77331a7bab1d51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
870322e863b2306f2ab6f7d306ebd898

SHA1
31757b1b7e83e5864bf900c71c5238b0c7e57def

SHA256
4021b3fb95d0a2ff0af905a8e8afa8da4ff5715a8fea59cac01898fd62002cd4

SHA512
5412458306da579be6bd3dc5ac403ff72c32f92d603419fabc97558d78993e85138915347e3059910f2d16f49ba6cf6140242e681911a0658a83c1eeb6fdb1be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1dbcaa2176465959e7a854948936e47b

SHA1
cc1ae966cdb74a38cc407b1732dc8eee49f51cf3

SHA256
18ae4ed2091a19ad8867a67801e4008c0cbd93d1a54c115453c3e3a619c9b4a3

SHA512
29040a2d2a4e81daa05201c109830f9e8f07c3d03c24d5757183f0c1dc5094265a37951f68b6464572ae89ed98376622ef6f40754883aa38e62aff18a79bbae3

Download Submit