hxxp://14990641499064[.]hotelpostalongarone[.]it/criminals@wantedbythepolice[.]nl

Resubmissions

22-11-2023 15:32

231122-syz5qaea3v 8

Analysis

max time kernel
241s
max time network
284s
platform
windows10-2004_x64
resource
win10v2004-20231020-en
resource tags

arch:x64arch:x86image:win10v2004-20231020-enlocale:en-usos:windows10-2004-x64system
submitted
22-11-2023 15:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://14990641499064.hotelpostalongarone.it/[email protected]

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1452	msedge.exe
1452	msedge.exe
4772	msedge.exe
4772	msedge.exe
2896	identity_helper.exe
2896	identity_helper.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe
4772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4772 wrote to memory of 4504	4772	msedge.exe	14
PID 4772 wrote to memory of 4504	4772	msedge.exe	14
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 4712	4772	msedge.exe	26
PID 4772 wrote to memory of 1452	4772	msedge.exe	22
PID 4772 wrote to memory of 1452	4772	msedge.exe	22
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23
PID 4772 wrote to memory of 4328	4772	msedge.exe	23

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd938846f8,0x7ffd93884708,0x7ffd93884718
1⤵
PID:4504

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://14990641499064.hotelpostalongarone.it/[email protected]
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3968 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,10775540900254470146,5666465006948476440,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2044

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4840

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6dded92ec95cf9f22410bdeac841a00d

SHA1
83c32c23d53c59d654868f0b2a5c6be0a46249c2

SHA256
1840d5c60c79874359414677662439087173c575d814c07ebe661ae1cebb639e

SHA512
e13df653c0364be2b61619fe3d46799e10a565b41f33d3ce15e50397f8f9aa328e8c821212efe10cfe3b8283c1e8c7e9eb15f9674fc456837d6ee8c38bc8b0d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
f6b2c93b1b2e76d609d0d2c523eaae4a

SHA1
8fc70c2314240a5e14beaf0ae5d81ca29ff6ad55

SHA256
da49d53576ce9a6004f51dfe958dc7409fe868b04a766bf0d80923e4f4937810

SHA512
43c76114a0ed11da4c051bfe83ea201c104141c7292a75c1f1611d0148fa6fd9ad11a3ffcd1aedb1795cec451b19352682ddcaf196d68c4b2afb4cbac4d4d93f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
982B

MD5
d47c26372d8b07d1e5aa2d22a0f4eeac

SHA1
8fced426dea2484f24c19cf0f42a0bda678982b2

SHA256
d1b64f662066d55888424919724a03f429c815b747e1aac5ffb02a9cfe61d3d2

SHA512
1c688962b77ae42481e00aa1cd5b81edb74ce65beb2e20803df2efbaa3e98958e2f47241126ac18b21d697b3bd2d55945d38e126a04911609e5bcfe6ee685d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
c21062ee9be6f17ada1671b69a8b3e71

SHA1
26403030eb10173d193874b467a77ccc6967c553

SHA256
e9c48e101053e9dd95c80e24e4abeafb3bd61933c2aadeb31807b1d317992669

SHA512
25c947a52b076b3a35552d4e649b9327ed6856ba259c8726dbfd37df6317a80a77b35c91fb6b34a9a43b1b39a120e797dabf49266298c894e3d749fe52a0b6d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ef1f230c601cd3fe96154e0725728ca1

SHA1
d3592d4237016dc266c8b80ccccdc2aa28155d49

SHA256
b0f33f6b10cbccc290a2abfeb27706c4035e61efc2bb8760d59ab8218e1cb617

SHA512
91aaa9eb68f3a75e601735fd7c4b99c241de43365ac9b1714ea326d0f2e360a5a05ec7edda99ae13b2599888cea35afde3d7642e8d6126348d246354525d4bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
64003738c715d736f299bd99b07b50f1

SHA1
74bdc9354053d83aaadc83433261c2ccbcc769f0

SHA256
1b7ca9ee1751cb3649de2bf0876cd975a6e7b0d79ea1564ff49495d11ec2bd9a

SHA512
59b001f7422e0ce854866f7ca589d74d8e6ab6abaccf45ced2373a5687d845d766f1d28000719b2dae96ca9fd0eb5ca456e5b289bccc94e599599ad4ca07884b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
e05436aebb117e9919978ca32bbcefd9

SHA1
97b2af055317952ce42308ea69b82301320eb962

SHA256
cc9bd0953e70356e31a957ad9a9b1926f5e2a9f6a297cdef303ac693a2a86b7f

SHA512
11328e9514ffaa3c1eab84fae06595d75c8503bd5601adfd806182d46065752885a871b738439b356d1bb2c1ac71fc81e9d46bd2d0daa1b2ba0f40543bf952b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
36ea7abc5e9fb94ea5081b6c93215a7c

SHA1
d4d3911fc1eaee345ec4897e575e0cdc2be5f7d8

SHA256
150cfda52958245381a03ffabd4a0d21c7c5bf0f86d3bb2ccca399e4a505da06

SHA512
71e3171adcc9d7297243b452985c0cb547a990476522d38c9b4dae1ac2bd0b2e273ccbbc1dd1f26ec31c540e60c4da32e189995e4f7ba0572849173d53291f15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
d61881c7e196743a5ffd1616b5562881

SHA1
b59f9947261ea2477b2ba8cfb211aa87a7c3ccc7

SHA256
b4297a05f9e9eaab2504884d31dc7dec08acb2e924edb92507e1f3af5d129e4f

SHA512
2ceaed70670f9c89e5786747f777e5dbbfd677f58adfeeb842cdef737b7869ae3c8af67c53cef697647745c100451db6a5b32ef8c713be00953892c258bee639

Download Submit