hxxps://cdn[.]discordapp[.]com/attachments/1042370929608626218/1208786130707816543/Your[.]Only[.]Move[.]is[.]HUSTLE[.]v1[.]8[.]23[.]zip?ex=65e48ccf&is=65d217cf&hm=509cf7e7882f4c58c1366ff93dd0e2e930b385ab692456527dda08a78a34bf0f&

Resubmissions

18/02/2024, 15:56

240218-tdmvbscd45 1

18/02/2024, 15:56

18/02/2024, 15:53

18/02/2024, 15:53

18/02/2024, 15:51

18/02/2024, 15:48

Analysis

max time kernel
73s
max time network
82s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2024, 15:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://cdn.discordapp.com/attachments/1042370929608626218/1208786130707816543/Your.Only.Move.is.HUSTLE.v1.8.23.zip?ex=65e48ccf&is=65d217cf&hm=509cf7e7882f4c58c1366ff93dd0e2e930b385ab692456527dda08a78a34bf0f&

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe
3732	msedge.exe
3732	msedge.exe
1832	identity_helper.exe
1832	identity_helper.exe
4396	msedge.exe
4396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of FindShellTrayWindow 52 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe
3732	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 5096	3732	msedge.exe	84
PID 3732 wrote to memory of 5096	3732	msedge.exe	84
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1620	3732	msedge.exe	85
PID 3732 wrote to memory of 1044	3732	msedge.exe	86
PID 3732 wrote to memory of 1044	3732	msedge.exe	86
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87
PID 3732 wrote to memory of 2828	3732	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://cdn.discordapp.com/attachments/1042370929608626218/1208786130707816543/Your.Only.Move.is.HUSTLE.v1.8.23.zip?ex=65e48ccf&is=65d217cf&hm=509cf7e7882f4c58c1366ff93dd0e2e930b385ab692456527dda08a78a34bf0f&
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc563e46f8,0x7ffc563e4708,0x7ffc563e4718
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2564 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,10617501846877867213,8643085491114087596,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
efc9c7501d0a6db520763baad1e05ce8

SHA1
60b5e190124b54ff7234bb2e36071d9c8db8545f

SHA256
7af7b56e2f0a84ae008785726f3404eb9001baa4b5531d0d618c6bdcb05a3a7a

SHA512
bda611ddba56513a30295ea5ca8bc59e552154f860d13fed97201cdb81814dd6d1bca7deca6f8f58c9ae585d91e450f4383a365f80560f4b8e59a4c8b53c327d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
186B

MD5
094ab275342c45551894b7940ae9ad0d

SHA1
2e7ce26fe2eb9be641ae929d0c9cc0dfa26c018e

SHA256
ef1739b833a1048ee1bd55dcbac5b1397396faca1ad771f4d6c2fe58899495a3

SHA512
19d0c688dc1121569247111e45de732b2ab86c71aecdde34b157cfd1b25c53473ed3ade49a97f8cb2ddc4711be78fa26c9330887094e031e9a71bb5c29080b0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0387c1488fa49d9574bdf6c230236cf9

SHA1
d9e4012256dfe4b9c2064461319831926c379b80

SHA256
0f07c7e98b5f470f5d5aa246435507da9bc8b6bdc4ad5146fef6ac34bca07fe6

SHA512
70cb50680b3ee0d4e5289cc99edcdf6ea65b89fde0db14eaa5a5aa7395cd89ad2b3273683d3d6f04a72161cfb38d24c3752f547405f5a52b3ad06d828f5f00b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9c7f8b88f013692b71f86fc897095778

SHA1
9c73cce67cd9add6e68561723e84715c4570811f

SHA256
2e1f548c5720beee9397ee59e221b5e8a4e1f888809975d53b45a75b63ebc085

SHA512
23a76c7f4278a95e685c73d094de7de728409fbffd542f9262e3c23f6fd8f68d69599217447bdeea9fdd53c2a2c2c86c8c6e38c674c70c149e18baeccef4ecf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
873cf3219237d57b19bcb3fd4ffdbe9e

SHA1
72992aa35891f8ed6cb0dd7e34da207cdce42f8d

SHA256
ad8baa6f2157df92e31163831734d7a8be5a3a8e8e58baabe217dde32b08f8c4

SHA512
ecef6953c2581fff289c03b0941ee7a88b1479cfb557ef10082e52802d0976dc5b754f8877b6a6a9f1a45a8210417fe464194d81f2bfc74b860c35a04f1fe636

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
35b049021550e46a8467af0a4e820dcb

SHA1
55ba5cf6a5b253cd51dba0c54b8e1956aaf0a14c

SHA256
3dc5cb4a445beb755e031f6ef7997c09bb57472b8cd712274bdb31e13b06d256

SHA512
874bd3c401bca5895f5ae672f198151dc403543850e2d16c34548895df0179ee350e2d6b81da91406eacd2685f193ef821420e70354f25fa8ee01688c95a1341

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
121510c1483c9de9fdb590c20526ec0a

SHA1
96443a812fe4d3c522cfdbc9c95155e11939f4e2

SHA256
cf5d26bc399d0200a32080741e12f77d784a3117e6d58e07106e913f257aa46c

SHA512
b367741da9ab4e9a621ad663762bd9c459676e0fb1412e60f7068834cbd5c83b050608e33d5320e1b191be1d809fef48831e0f42b3ecabd38b24ec222576fa81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f32c7b1b9cf184f7e8dec50e179a40b4

SHA1
54b3b77db2fd994053af17aa018c254af86e0be0

SHA256
0f68ee5c29b0b0b882614baad93fa58a11e8fb04ec8dc9d32cf728d22b39ed73

SHA512
24c3c1f52b123c7f9c0bc6c786663aad4acbe40b046dc37c97f9edd35b0920f09e5ffcc48eb9a0b59f1e5e080a5fd2d5b7ef8169b987906df3c148ef0a3b72d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
47755f219b8fba83d0c9c4819b9103a7

SHA1
42e7350f579fd46faf9266fac52253ef7a17c522

SHA256
4765235344dddd2b163da4d0cbe52a82aeca68c351875648f9b9a00a9a4814fe

SHA512
4bd811fa5715be3895075822e87ac7442d9e9a67e36d0a77d60c1a4006be37daabc2f45b61ad6c49459b64a8eed34d3a0d5f064ff15263a3433174aca7626e81

Download Submit