hxxps://email-trk2[.]mbird[.]io/f/a/AaJrIQLFifOk5loOm_VWDQ**A/AAAZ0QA*/RgRnfutUP0R0aHR0cHM6Ly9pc29zY29tbXMuY29tL3Jlc3BvbnNlL2VtYWlsLzEvM2VlMGI4OWQtNzNjNC00ZDM2LTljYzEtOTFiMzU1NTYwZDNlL1EwWnZjblJsYm1KbGNuSjVRSE5sYlhCeVlXZHNiMkpoYkM1amIyMD1XBXNwY2V1Qgplm1RmnGXYuKPpUh1DRm9ydGVuYmVycnlAc2VtcHJhZ2xvYmFsLmNvbVgEAAABFA**A

Analysis

max time kernel
144s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/01/2024, 07:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://email-trk2.mbird.io/f/a/AaJrIQLFifOk5loOm_VWDQ**A/AAAZ0QA*/RgRnfutUP0R0aHR0cHM6Ly9pc29zY29tbXMuY29tL3Jlc3BvbnNlL2VtYWlsLzEvM2VlMGI4OWQtNzNjNC00ZDM2LTljYzEtOTFiMzU1NTYwZDNlL1EwWnZjblJsYm1KbGNuSjVRSE5sYlhCeVlXZHNiMkpoYkM1amIyMD1XBXNwY2V1Qgplm1RmnGXYuKPpUh1DRm9ydGVuYmVycnlAc2VtcHJhZ2xvYmFsLmNvbVgEAAABFA**A

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
1280	msedge.exe
1280	msedge.exe
2692	msedge.exe
2692	msedge.exe
3908	identity_helper.exe
3908	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 1784	2692	msedge.exe	86
PID 2692 wrote to memory of 1784	2692	msedge.exe	86
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 3056	2692	msedge.exe	89
PID 2692 wrote to memory of 1280	2692	msedge.exe	88
PID 2692 wrote to memory of 1280	2692	msedge.exe	88
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90
PID 2692 wrote to memory of 3492	2692	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://email-trk2.mbird.io/f/a/AaJrIQLFifOk5loOm_VWDQ**A/AAAZ0QA*/RgRnfutUP0R0aHR0cHM6Ly9pc29zY29tbXMuY29tL3Jlc3BvbnNlL2VtYWlsLzEvM2VlMGI4OWQtNzNjNC00ZDM2LTljYzEtOTFiMzU1NTYwZDNlL1EwWnZjblJsYm1KbGNuSjVRSE5sYlhCeVlXZHNiMkpoYkM1amIyMD1XBXNwY2V1Qgplm1RmnGXYuKPpUh1DRm9ydGVuYmVycnlAc2VtcHJhZ2xvYmFsLmNvbVgEAAABFA**A
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5a8346f8,0x7ffb5a834708,0x7ffb5a834718
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,124803821779724710,3343226008231663154,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
  2⤵
  PID:1176

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1176

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
814a9675efadca06d6cc9caf93ea696d

SHA1
fd47fe653e26a2a6bb46bfb3d1d2ca6abbc5e838

SHA256
4315ecd90fa6d8ac92a68fd4db5653f9c09c0796909ac1e7a20694a31e643064

SHA512
9291d0f02c6a4f906021c4dccc92642481e41caa131e5c1d3a8fc2b5e4aecbc1d175e837903ddc3f08a46b67db78656cccf5780ffc0f9090dd3b47b5053c156b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7f817126e34f7e3ec4a0b64999e0a392

SHA1
95fa805987b4a3a846eef5aad45320b7a3984b9f

SHA256
59926a6a05428df0f4c1a5e4fa82e78f0c7a4bbbf180beac96364f11ac93fe6f

SHA512
aa59c95a463fe95eac4bd967fcf7185e18a718e8081d347e8aaa9a6d5476f6a3efb346b43c13efcabd9710fae7c94386b39677e9d42139c0ec54ac3d39860550

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
18d42f45981c87756734cccc0bf6d6f0

SHA1
d2be72fefbff23ae582dc74d330ae489fc221dea

SHA256
b40bbdbfa3b702806b407a60af13944d2fab1f84a829c20a08237200a2c6e88b

SHA512
e0a423cbef3ce0303844ca6303dc32923289c329a3e7a4138d22c9d0c71bf04575cc26961f5831013c698ae45c4374182b24b394476fbfc6f9ee1bc9f8731565

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
72cc545ba9c8b5388f55a422e4f72c5f

SHA1
b3200bf0208089326b154d713e6406db5c8ade92

SHA256
b9c63315029d40bcd8fdd3cb7a2d9881f41ac3a47367185dfb91fe5b2bbb557d

SHA512
05e5c90afeba22a422bac9cf3fb4305fc38500a0ed3a553e1a6e8f8290e646c729bc23fbb58df08f27e00881897a9694dde6befc96f1b77fc395274c85159a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4537abf3b459daca5846dc0cc28cb01

SHA1
a50c6d9690a14f3a47a76983e6ebbf82139be86c

SHA256
2aeff2c7157cc0c051ff3c79eb59482b3c95df0817d000bc4acbed93a68b8467

SHA512
2cbea6b9c5bf252bf227891036eaf7a12505a582a2e30cc0c9ef6dcfd608ba4b656bde2a6ec38a8bbfbe215b1e8322b24e9c5adbc366f8a37367f086d9db3675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
91ee2f788fae043be953b22e47086843

SHA1
73c090140dc2c8d42b232e28f1b4ca70e3f31739

SHA256
fd2573962214f9bbff5fc46a15e7465bc6d73822aff07f3deb680a50d19d9132

SHA512
75497539b03b313e6e7cfa24afb164a3b78ce2832e19ba356a68af0eac3029bb496cca916797e82a8110f0babd13bbd941a42cb15cc0be2ca2695ad3709e5b50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
be640ac151c963232f2832d4e1a4e46e

SHA1
52c7622b7db05d4bdfda67eeb7f73992d84447ee

SHA256
e026579077ad126522e71c3cee9baf6f2b9ca98b43a729608bc412d06c30d465

SHA512
d4770a67afc9a4fe45bb9badd225b22347691d4be62572eb2d667579400956ac6f981186cb11b2fb2cf5037a90fb3827f4610b9fce83a88f7f316f2eaebbc0a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f1cc379e3dda60c8cf235de3139bc725

SHA1
fd3987f347476988a6d3450bdd58de2f77542367

SHA256
5bddd972d5a7ecb87731c2bb55fd057ce6fce8ea107939fd8ca40558e35c584d

SHA512
5f8f104e7a5effbe4fdd58992649feec2a57915cf953bd756411ea754ff0d005c6f2e136a36f2244aac55fa35216bfcd9a007a537d68d69bd0b6bf57da004e7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e26d70ba5754acaebd8f75e02395ab3b

SHA1
8513df82bcbfbb83a041e33faa62fb97436d2b47

SHA256
e915997b79a78e2050f50b5f4d1b9ce4354745179a40e2f520bc0e8a9c6a69ab

SHA512
b19cef34b2152dd1b94c68a5212fc5b6f5817009aebc098c52cfecd2277df71fa5bdb299278d0f9b0ed1e17dbd11d5a77738d1618145e43cf37c323b4d442904

Download Submit