hxxps://lumiere[.]rs/pr-vesti/dodeljene-nagrade-kaktus-2023/

Analysis

max time kernel
147s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
07/11/2023, 08:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://lumiere.rs/pr-vesti/dodeljene-nagrade-kaktus-2023/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
464	msedge.exe
464	msedge.exe
2796	msedge.exe
2796	msedge.exe
2672	identity_helper.exe
2672	identity_helper.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe
5532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe
2796	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 3196	2796	msedge.exe	44
PID 2796 wrote to memory of 3196	2796	msedge.exe	44
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 4204	2796	msedge.exe	88
PID 2796 wrote to memory of 464	2796	msedge.exe	87
PID 2796 wrote to memory of 464	2796	msedge.exe	87
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89
PID 2796 wrote to memory of 3424	2796	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://lumiere.rs/pr-vesti/dodeljene-nagrade-kaktus-2023/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd600646f8,0x7ffd60064708,0x7ffd60064718
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6152 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,9229506798206681936,17408699751490746872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5596 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5532

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
483924abaaa7ce1345acd8547cfe77f4

SHA1
4190d880b95d9506385087d6c2f5434f0e9f63e8

SHA256
9a111c2b76c1b5f6d4f702502b9ff4326b7b5682921c2760286dd073824cb684

SHA512
e4ac0a0d5f06e056901c68488e34358a32a5bc7aeffcd82af7eba6043d0fa35eaa67a67c3716dcb661aaca441677819bcba7d35bc4efc6103f3ce32f78e32310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
72KB

MD5
6bdc1d78636f3dd1af1fbcace570f767

SHA1
530be874f55e0d2fcbc5e13173757d07160a1676

SHA256
2cf4c905c5892e161be2ad11ac2e602eaf14929aec4c962ee1192a48d7adb926

SHA512
d4039eaa32be92e28abd616a2719efcd9abe4b4e573a6641d729ab0a80aeced9cb4cbc2287a4ea29619e878f4bc7430c1f021da0b34e15d50564ca550b71a60b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
888B

MD5
63300948673937025bea225e8c54b458

SHA1
1a806b2058d962d4259cc215c8e1a24a6acb5452

SHA256
f9277b42230c3bff6e88a5786f70f4ba5a10d0d1ba2025643eb8b52685e5bd6a

SHA512
686ea5a6b64739119863d01cee3ef98f1824b80725a290def3eb45689384567299752b4f3ba907cf55ca95fdab7e1eb526db1b981d8f7c032b27bf2552c9714c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
817dc52ddb586c77bb46a802a5b0c07d

SHA1
d1ef6237a15998e8f931295bb993181b28cc6600

SHA256
0b18825a573a9971ba3bc09db1ef6f90e35e7294341ed587e3a2193c91398081

SHA512
a634e821a6fcae139dc4f8a2787db1007aaa8385775207c23dc71c257d9507ec07873753d5b240f6891053276edc72a243f8f7658c0f7cb61fa9bac7b469134c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8610d3acd2c4bfc4f5d737c9b7f07510

SHA1
22eab6913130ce7eac5b56af6714ae4b44c4bdc8

SHA256
1201e4530b07eb0e9021abce632d01906ba78da509eeab2a4fe084f77da6592d

SHA512
8b2d5cca5e83eef949319a3a6d7271a55d0a12500edfa33e090a6e89e59a3cea12eb0ccc441a41dd97e28d711a608479ee72e359d6df1ada8f43127e3eb1d2fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a274965568f59265f49c90b2e64ad602

SHA1
34d5321a5cd371636c75b0c8134da92774575147

SHA256
486d3eec828e77205745bb3388e470adf6cf3eb202ec9320c327e2ef96185cfa

SHA512
b65d8e7a8f8788e4985feea034b2797bd9d298464449c4cc706a6af0b05790600e3f29d325c2ff0a36f6750a8147b400b979ee4952cc30cdc07e02447b218c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
1c706d53e85fb5321a8396d197051531

SHA1
0d92aa8524fb1d47e7ee5d614e58a398c06141a4

SHA256
80c44553381f37e930f1c82a1dc2e77acd7b955ec0dc99d090d5bd6b32c3c932

SHA512
d43867392c553d4afffa45a1b87a74e819964011fb1226ee54e23a98fc63ca80e266730cec6796a2afa435b1ea28aed72c55eae1ae5d31ec778f53be3e2162fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d4c188487c46ec3666979dabe675d04a

SHA1
b3370657f4ab7afecbefc33a113c881e05b1e094

SHA256
41524438148f44b7576fe1bb167edd14faec73884daa125678e09b6e8377d245

SHA512
d51926c9371cc87f8cc4365aca79d7a386a490ce5e7b63b3fdc88e8219a3b02119f1ebb8f47c2ea7c2e429bee327f72c58e2b2638eca30ec6221b6fce45a36f0

Download Submit