hxxps://bpigytcontinentalgt[.]bpi-gytcontinen[.]repl[.]co/

Analysis

max time kernel
191s
max time network
202s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
02-01-2024 22:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://bpigytcontinentalgt.bpi-gytcontinen.repl.co/

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1368	msedge.exe
1368	msedge.exe
2480	msedge.exe
2480	msedge.exe
2096	identity_helper.exe
2096	identity_helper.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe
1620	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe
2480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 3992	2480	msedge.exe	87
PID 2480 wrote to memory of 3992	2480	msedge.exe	87
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 4820	2480	msedge.exe	91
PID 2480 wrote to memory of 1368	2480	msedge.exe	92
PID 2480 wrote to memory of 1368	2480	msedge.exe	92
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93
PID 2480 wrote to memory of 4636	2480	msedge.exe	93

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://bpigytcontinentalgt.bpi-gytcontinen.repl.co/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ffbb40346f8,0x7ffbb4034708,0x7ffbb4034718
  2⤵
  PID:3992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2592 /prefetch:8
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5396 /prefetch:1
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3632 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,11011681577718653817,5762412605741317616,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3304 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1620

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fa070c9c9ab8d902ee4f3342d217275f

SHA1
ac69818312a7eba53586295c5b04eefeb5c73903

SHA256
245b396ed1accfae337f770d3757c932bc30a8fc8dd133b5cefe82242760c2c7

SHA512
df92ca6d405d603ef5f07dbf9516d9e11e1fdc13610bb59e6d4712e55dd661f756c8515fc2c359c1db6b8b126e7f5a15886e643d93c012ef34a11041e02cc0dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
113db17f0fe03ee026b5026109aa3af0

SHA1
0c8151f4125d6a7e598f3f61f9ba7cc353d2b906

SHA256
29d85471b7f8e0db056285dd9ece92db0544cab2783b0bf19abf1ab71eb942a1

SHA512
d029e229b65d12422ee804054986c483c214cbedce85eedc128f78b29d7097c2199d752de4c8e0fe4cd4aae1de416531a33bdff6c2c2bb6c99ea27a556776e11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1230e5ede77e178b54ba0552d3c2d2be

SHA1
6dce20286d1341779723fb89d7cad770a1f347aa

SHA256
e9bde09e4b40fc61771d6f7051ba4f01c4fc1121472f53e815e9c046322557be

SHA512
e9b72c15bbebbe9371a8f266d35028648a40548c938a92b8467888f6f30274fdf3fc8e3dfc61b00e31ab4012eb5fea7f68c19447a7438dc5234f67e77b88daf0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
519664039a8ea85b6b8745f662770b38

SHA1
d64df28839439c5c3ab042516dfe661a112235b7

SHA256
dbb0b017af05b1867d95ccb5be7db90255ab2eef853a1448682babfbd18504e5

SHA512
d28e9b150e65cd06b010987590f1f713764719afb5b3fa32016132103622a4547cac982bdaea1cd982ab18c6f4fca4c2e399e1701e86bc432a0808111a223212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5684d7cfb9665b22e560315af123b473

SHA1
8100a5eccea3f86afeaf2b7774e42d544d9efec8

SHA256
ee88d7979fd4cb22ab379fec1692ef4d04f181ca63929fb4b3dbb423ca72f321

SHA512
6a7580cc5a575be6863f85e1b9ec252df467f3635fb68bf97f61ff1994f1af254d187d39f914eb4a7f6e0393afda32ecae02844aa3d0f25ee160702ef85f2081

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d4d23611a11576dfb55061f5d1b6a734

SHA1
546f89d9dfb1c6bb6fe7c5cc0fa95bc26964f7fe

SHA256
72e9a55840b3b041984520b155ef92f513e4cff7f7c93ce93c2948f283918e92

SHA512
c53d8866b50c7d353792a753b995837004052e9e37ba385ac74b1517163d4d0f99f6e49d25b35b6cc6de9fbadba3731aa270dbb2650ce30aafccb643c42e43b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
917dedf44ae3675e549e7b7ffc2c8ccd

SHA1
b7604eb16f0366e698943afbcf0c070d197271c0

SHA256
9692162e8a88be0977395cc0704fe882b9a39b78bdfc9d579a8c961e15347a37

SHA512
9628f7857eb88f8dceac00ffdcba2ed822fb9ebdada95e54224a0afc50bccd3e3d20c5abadbd20f61eba51dbf71c5c745b29309122d88b5cc6752a1dfc3be053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
225402d31c6389ee8b0c80a10c895b2f

SHA1
5ba988bada9fd8c4d8f2944ff1d2d2c63a5f0814

SHA256
4eda4a274920991b2f0aebd16becfea79d4146564c55a69e7f3ede1ccf5de179

SHA512
81bc57a11a882f9e09fcb673328fbd18a0975f3978c794963fef200b775a03b2051e951865ae85342cdf2e13d147e381cc7a3569066b3d2c4f6b69b428503bb4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
75879554a367cffacd45c0be97e4defe

SHA1
169bb663049eee368ef0786ce540751a3d552d9a

SHA256
c7b8c12d41b26f3d752d774fc5ad6774ff8ed6399dd6c222aefb9e0b69de7e82

SHA512
bc282862b34e93ece824c84a79b5350bad836c5d33b6d4c5b4251c60e6477fe3eb71d2cb118ffd2f1514d0507eef2f7c716e757eb7e978ae20958e1c9041a01a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59b53d.TMP

Filesize
203B

MD5
6d25f4f3f0f30593b5ba97ddd3ffe4d5

SHA1
f72f3af7257a097b46dbf9890f646f32c4829294

SHA256
9b2e3e86ad84009bd1e055c76329b4a3f69e51d21e4ecc4038c24181b53a2ab6

SHA512
66bde11a2ec7dc686339b90e73bd77a299c1a8c2496665190150e0767df986c2bd429ca71b9557b2c6a5d25acbbed7843b8677536360de59f35b7e2b44d3b877

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b9d3b18404a37c5a234c79dfb5dc7266

SHA1
53b20c90bf55b23de96a0158bfe5604ced2bb3b1

SHA256
a42da94efedf382bd11252180fb272ca50945bb1b2b5900da9baf1b9cf8f64ee

SHA512
4e2f0e917d2ca2f48f1b97e4d0082aa563c768898fcef99e1d3f8c110e479433c371d55e83769e21c852a2082fb6c53345d7d2121573f7fad101f467b6f83557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
3KB

MD5
87364d43357060061e4de9b35940ada2

SHA1
0fc807d7e329860834a2d75290c36ffd347b22ca

SHA256
b5af959789f14a506cd9110f3e31e5f05691489e7c609b0b6f739b83108cbebb

SHA512
4210c7fc48b6bc3405c5090f833003d9f3e325abf7d48b0d602f1f254f4f84f84418ad118cbbd865236e66ae971611087bcc353be6bff46ccc5cfdd34a01e669

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c934567566fbd2daf9de38098392df94

SHA1
fe46f66217baf5f50a9d5245c6376194d8fa8bdb

SHA256
9eba0511ca42169b9331dcd7a446a04fbd9ef5d39d5dd6a62a9b9b8b755ab409

SHA512
0e4c3292f5ad1623fd98df8e8010296ce51be23dbd42d2182cd1e08ac717b6924c23c3f8167641e218985a37104bdc837522519db363ea159289a04efd3224ec

Download Submit