hxxps://r20[.]rs6[.]net/tn[.]jsp?f=001d-Je6n0xMWDh6QSL79LZ2FgdVztlu5b0P1iL_lk10zTk_lYmMJ_zY-qZceK8XbUri6iMgniNVrb5jxotmOSC-yMfvwRPkACVpJTlFb3KV17LQuRyXNLI67UnysExfRB1nK5SdNXWea67w2Z-7UloNA==&c=&ch==&__=/asdf/ZGF2ZS5ydW5ja0BtZWRrZWVwZXIuY29t

Analysis

max time kernel
147s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20231023-en
resource tags

arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2023, 13:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://r20.rs6.net/tn.jsp?f=001d-Je6n0xMWDh6QSL79LZ2FgdVztlu5b0P1iL_lk10zTk_lYmMJ_zY-qZceK8XbUri6iMgniNVrb5jxotmOSC-yMfvwRPkACVpJTlFb3KV17LQuRyXNLI67UnysExfRB1nK5SdNXWea67w2Z-7UloNA==&c=&ch==&__=/asdf/ZGF2ZS5ydW5ja0BtZWRrZWVwZXIuY29t

Score

6^/10

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
69	api.ipify.org
71	api.ipify.org

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
1192	msedge.exe
1192	msedge.exe
4556	identity_helper.exe
4556	identity_helper.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe
5860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe
4704	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4704 wrote to memory of 2140	4704	msedge.exe	87
PID 4704 wrote to memory of 2140	4704	msedge.exe	87
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1320	4704	msedge.exe	88
PID 4704 wrote to memory of 1192	4704	msedge.exe	92
PID 4704 wrote to memory of 1192	4704	msedge.exe	92
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91
PID 4704 wrote to memory of 3996	4704	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://r20.rs6.net/tn.jsp?f=001d-Je6n0xMWDh6QSL79LZ2FgdVztlu5b0P1iL_lk10zTk_lYmMJ_zY-qZceK8XbUri6iMgniNVrb5jxotmOSC-yMfvwRPkACVpJTlFb3KV17LQuRyXNLI67UnysExfRB1nK5SdNXWea67w2Z-7UloNA==&c=&ch==&__=/asdf/ZGF2ZS5ydW5ja0BtZWRrZWVwZXIuY29t
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa92846f8,0x7ffaa9284708,0x7ffaa9284718
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2940 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2932 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2548 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5812 /prefetch:1
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,222455789225295264,3281453196160146208,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5860

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f4787679d96bf7263d9a34ce31dea7e4

SHA1
ebbade52b0a07d888ae0221ad89081902e6e7f1b

SHA256
bfcadaffd49f5351acf68b8249b32270424bc2459125818492cd3224662a9a87

SHA512
de3f3d1cd602bddb664bd0d2aecb661204dd239b278b1f03d6b9dca6f3d03bd3041ac42f4382f5edf5b310b17ff9ecddff59f16729e8c095625040a364252307

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
92cd9723e322d19b453fa125488a88d1

SHA1
0b520331a966bcd05624504a5aeaf1414b69cb2b

SHA256
652f8b93932a7229edcc180fba9af69369a186b0d63c231abeb43004a6015015

SHA512
1c770ec70adfe9747cd0ab9d3630e283ddf42c500f954dd7ca629c7aedd4af93c2d477d3b42b32921b6957c8a80cdcf484b0252a9e9e80e9675996952225f857

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
824B

MD5
a99127b2ea7477a372dbd8a5699f05ac

SHA1
b8e12c5e1445b96bda7dda758cc99ae0e1a04ac2

SHA256
098fc02a72a12e8372d69c35b80faeaef6226f436ba056c809ef28ceacd934db

SHA512
12c224a6cf659b3d7d06e24f5dd95b47ab6cd3f4adc909e4f3141196e9235aaa293015fcc3bb790f8c8bee5977f2fd7cd202539d0ed78b565e71564931ae0abb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
583909163e14311258db3cc53dd7dfea

SHA1
1a739760520024dbed32dcc3b883e325bbda94d7

SHA256
fee9f851fbd7303ffeeb29e7e04b40487e025bffb42da53758337ba8ab2b369b

SHA512
b9c6e5468274f1528b13d8c9ca2ecba9b308d802ce8a6be16787d617efaa84e2404289939679c563a7f2e2acc8caf4997902ccc274b929dbe6233e1e628854a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
cef5915e56c78da44b1dc65f12e76e75

SHA1
1404ca4d532a3d37efbff9339f401bbc4ba17b22

SHA256
1b0bfc223eaef533762681277ed70a01fc179dae140fa0b6d56f015cd75fae5f

SHA512
d5d007aaf5f78609c3dc0d37b3e0d0184d412114a76452230d77b117493c7cf0c0a90116e6d81bddae861310dbe301a9d586e388cf8515807313329d7475abca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f52b03644bfec9602cda6f2bd3dfb5dd

SHA1
a2fab9846f3096c0255902e982efe368630a1e26

SHA256
e2014d1768dcd3c796c7760558ce472887050195a034c71a5c899fb9b3c9dd5e

SHA512
ec779431a86a8d6f86a70b3414768cc31ead2315eda6119ea1caa947c1b04904853f5349452624ab646e616c29e2b23feea222e0bb148e7f257e7b9516989b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
3a748249c8b0e04e77ad0d6723e564ff

SHA1
5c4cc0e5453c13ffc91f259ccb36acfb3d3fa729

SHA256
f98f5543c33c0b85b191bb85718ee7845982275130da1f09e904d220f1c6ceed

SHA512
53254db3efd9c075e4f24a915e0963563ce4df26d4771925199a605cd111ae5025a65f778b4d4ed8a9b3e83b558066cd314f37b84115d4d24c58207760174af2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e03b7b9e5c0f5724c4074dc72b60d3b9

SHA1
cffe3ed55e68ac33e6d588f4c8ee01163c311f66

SHA256
9c44b47e92c40b06ea092a415170afff989841704ae8492f20ca297d0ac9ede3

SHA512
d50ed99a7ae0cd4cbdf40945c445d10b0868a7759cd2c84377f235a2105a9cf464318acb17556ea38345301c9ae8426bd984006d4f6a00a4051dd0e21ecbf5b8

Download Submit