e1e6ad1895ffcebadeffc8ee0986c6822f6993f5290ef72622c196e4d12a5b0c

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
29-02-2024 06:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adf4f4fb8385883513fd0018e347e7ab.html
Size

69KB
MD5

adf4f4fb8385883513fd0018e347e7ab
SHA1

48d4f5340bf0909f7be35433bc9d096660dfd759
SHA256

e1e6ad1895ffcebadeffc8ee0986c6822f6993f5290ef72622c196e4d12a5b0c
SHA512

67cbc1f001bd84572b8023d889563bb1e13ae10ebfd3412544668b8a9d11ac5d9bb0cd3c829e914441a480371e32c9c7dac6f0d9568e1ce33175f64c5ea2833f
SSDEEP

768:S00hqGbIiP//mdvsYSgLj/DVWmTMYq8Dfr7Vq3t40MSxjfLD+PHgkyMrj3DZ+/V9:SlIk/WtnwOHQwucc

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1404	msedge.exe
1404	msedge.exe
3944	msedge.exe
3944	msedge.exe
4312	identity_helper.exe
4312	identity_helper.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe
4648	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe
3944	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3944 wrote to memory of 3388	3944	msedge.exe	52
PID 3944 wrote to memory of 3388	3944	msedge.exe	52
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 4868	3944	msedge.exe	90
PID 3944 wrote to memory of 1404	3944	msedge.exe	89
PID 3944 wrote to memory of 1404	3944	msedge.exe	89
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91
PID 3944 wrote to memory of 1776	3944	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\adf4f4fb8385883513fd0018e347e7ab.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb591c46f8,0x7ffb591c4708,0x7ffb591c4718
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6124 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6252 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6260 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,1112797730020106179,12421245919785619179,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
47b2c6613360b818825d076d14c051f7

SHA1
7df7304568313a06540f490bf3305cb89bc03e5c

SHA256
47a22bea2e7d0154c59bf5d8790ec68274eb05e9fa6cf0eab0d648121f1a02ac

SHA512
08d2366fc1ce87dbe96b9bf997e4c59c9206fcfea47c1f17b01e79aeb0580f25cac5c7349bb453a50775b2743053446653f4129f835f81f4a8547ca392557aac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e0811105475d528ab174dfdb69f935f3

SHA1
dd9689f0f70a07b4e6fb29607e42d2d5faf1f516

SHA256
c91388c87878a9e2c530c6096dbdd993b0a26fefe8ad797e0133547225032d6c

SHA512
8374a721ea3ff3a1ea70d8a074e5c193dbba27ba7e301f19cea89d648b2378c376e48310c33fe81078cd40b1863daec935e8ac22e8e3878dc3a5bb529d028852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
195KB

MD5
89d79dbf26a3c2e22ddd95766fe3173d

SHA1
f38fd066eef4cf4e72a934548eafb5f6abb00b53

SHA256
367ef9ec8dc07f84fed51cac5c75dc1ac87688bbf8f5da8e17655e7917bd7b69

SHA512
ab7ce168e6f59e2250b82ec62857c2f2b08e5a548de85ac82177ac550729287ead40382a7c8a92fbce7f53b106d199b1c8adbb770e47287fc70ea0ea858faba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
b8444da47a5d1e3caeafa5bf613349b6

SHA1
578c0fa589ac24843e6572ea0b30b7a2b0e6fe34

SHA256
638ff146eaba5a7e1535dc1e58ea6a709339c94d3daddfa153758903d986d98f

SHA512
eec78f7a86fbe9563b3f4cdcba07f0882687e607fb5c6c72b9d7f67411da5d7465011a4d535d07c3db3a3f7bf07bf5f415605e56edf260eb906210a7a9e771c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3b2be253ce1ed571fceeb81f213539a3

SHA1
b392d60346a68a50a2a27db5623e63504a9d1c9b

SHA256
731a0a5a7ce1c9ef98c8c4b1224c0030c42d29cd70888b37aef5b365cd058d57

SHA512
4b23628e2e074840a1f34004840a0bff9c60d915e7eea651dbcc01c7aa955aaaaaa36e6c9e49cea18f2248b132d54d253234833e43d0526a6de80aa793e900f3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
47e2cb90294458fe981b1aa95721ef7c

SHA1
2c230af5ac59d6a9151ba7b96ed6e46741e859a5

SHA256
367d78023a93edc5d49172ce4834575a477bdbd9776607214e9954c72c35103a

SHA512
43f0686047dd3b6a03d89cd505fdcf12210b88f5f7cfef3bf64feb34dff095dd194f3f52d9b0e0ff87383a0dbe947ffc777d027fa297d10c198d197008a42712

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
876766ed54126cec9ba2d5302c2f06ff

SHA1
280c48b8ef29773dbaf9cf73977fd6fc776ff0c9

SHA256
6d9a824b0d8dbaf5cf8cefafc2be37e8f37d7cd56f299d86af1dc208abf9e3f2

SHA512
b2e882fb2a7feac2d3fb3f9dd3ea58a276719aa49fbe9350d70bff064302dc6b774af2dd407ddfbae94e9f23004fa234539bee5c97b1620555c2575ab06ff90a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4acb1ebcb463633948ce252a16d7de3

SHA1
87cba8f7fbe230d557d3c1af4e062cfbc32662d3

SHA256
4ec1377f99878cac7f5b6b9c2ef86a228fb2f9d9a169f8358adee9906b0932e4

SHA512
b1c0b826265c572f3e891244a4099d7d0c7f9d0e570ff1243ac925cd68ccc007aaac64f31b052afcd44ffeb4a9acc230f681493d57c4ac9092d4e1d50aca4c1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9e94c4c9bac46f16ccc16e2abbfb1553

SHA1
b4af2ef479df70346006254850f68c3451154390

SHA256
873b45843c2605ae676ed5b1d34a78649aac0ce754af6dd943feb61d623c4075

SHA512
601a251f937fbfece1701a65c8820dd38bdbf477fb105cbb6a7d4ef7f5b301a445221aaf79bec197a022397363f68fa77fca783b51f64a19965e908d7fb69ad9

Download Submit