hxxp://envs[.]sh/huK

Analysis

max time kernel
146s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
10-03-2024 17:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://envs.sh/huK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

Processes:

msedge.exe

description	ioc	process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

Processes:

msedge.exemsedge.exeidentity_helper.exemsedge.exe

pid	process
3432	msedge.exe
3432	msedge.exe
1264	msedge.exe
1264	msedge.exe
3300	identity_helper.exe
3300	identity_helper.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe
5760	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

Processes:

msedge.exe

pid	process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

Processes:

msedge.exe

pid	process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

Processes:

msedge.exe

pid	process
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe
1264	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

msedge.exe

description	pid	process	target process
PID 1264 wrote to memory of 4672	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 4672	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 2840	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3432	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3432	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe
PID 1264 wrote to memory of 3592	1264	msedge.exe	msedge.exe

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://envs.sh/huK
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1264

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff967fa46f8,0x7ff967fa4708,0x7ff967fa4718
2⤵
PID:4672

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
2⤵
PID:2840

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3432

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
2⤵
PID:3592

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
2⤵
PID:4620

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
2⤵
PID:5076

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
2⤵
PID:4588

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
PID:3028

C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5248 /prefetch:8
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3300

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2684 /prefetch:1
2⤵
PID:1004

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
2⤵
PID:3316

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
2⤵
PID:4832

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
2⤵
PID:1200

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3936 /prefetch:1
2⤵
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
2⤵
PID:5160

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2000 /prefetch:2
2⤵
- Suspicious behavior: EnumeratesProcesses
PID:5760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,11348266720503125829,3943138573711741538,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
2⤵
PID:4280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4136

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
fd7944a4ff1be37517983ffaf5700b11

SHA1
c4287796d78e00969af85b7e16a2d04230961240

SHA256
b54b41e7ce5600bc653aa7c88abb666976872b2d5e2d657bfc1147a0b49e9d74

SHA512
28c58a2ccf39963a8d9f67ea5b93dbccf70b0109b2c8a396a58389cdec9db1205523a95730485bcbc9d533867cbf0e7167ad370fd45740e23656d01d96ee543b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Filesize
152B

MD5
a774512b00820b61a51258335097b2c9

SHA1
38c28d1ea3907a1af6c0443255ab610dd9285095

SHA256
01946a2d65e59b66ebc256470ff4861f32edee90a44e31bf67529add95cafef4

SHA512
ce109be65060a5e7a872707c6c2ccce3aacd577e59c59d6e23e78d03e3d502f2707713fda40a546ed332e41a56ef90297af99590a5ab02f686a58bcbf3a82da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Filesize
120B

MD5
93b9bdbd1a8ef76964d9abd57a5235c9

SHA1
3af680cb74efae299c97abf27a647f50953c0c9c

SHA256
5b86a0d3f70d1c0661e837f3effa9948d73c0b24d0b2041d32c36079708cabd4

SHA512
a4be54ccd65ae3212963e0eaefdfe62907658d3e0bb97b1320a461299addaa3357d34e66e2d707a9077a8c136a31fe0c6c8306b54cd501c93c0fde5d1eae2302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
533B

MD5
f8ab74ab4d67ab5dcbc0f77872ac91d9

SHA1
57082e0032a37402a2623cda384e687ea989afc8

SHA256
46a0e6dd93813ca6f36228c27981bec9c654f79ed1a079728c9a18bf68360587

SHA512
2b398c25de9221a7732ef4e8f482daa92c1a7823998325af21f5cc31dee2b65176f594b179bd703be04f8c0170a55706272e1953975dc746ed58a98cafd74c9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Filesize
690B

MD5
ee7732e57ba8cce68465192be14f1246

SHA1
fd861b679734d4043f6f2324e74beb3fcfccbcbb

SHA256
fc21e423e59867508643b41cba49be058c277c240d26adfd59ef01291497f077

SHA512
c1a76584865c0fe84643d38f9eaaa972e82e01f95d6ef3524104ff5da94a8e179f28ba16068d64af21d5aa1353d13ca9bd43ff62f7e6d0e1e94a41804641d6a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
88b11391cb9dfd823d25bea469b2040e

SHA1
c5529e7eba52a3c9f97256b71ff7e0b877f7850f

SHA256
f4f13839062b77c43ab666c6e16d8484ba3ed1b335b1b3eab914295413bbb2f3

SHA512
5257057534a08c130ea762e8ebad065667412960033193a38a99bd98f32efe21f5ef359254b9e582cf1092c773be625fa07b0303cc28b6caeb9829b18fb660c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
6c76cdca026cc97e37b9e6db07380b0c

SHA1
38aca5b4663b313f27c94c7f864bae3653de3e46

SHA256
dc4c088c2f72232e147c24653702c7450449b944190a9edd7a9d031764d82c18

SHA512
99a91075f4ce93dff05baed10c001e19b13251dad60f2b6c403fbf9f031f97909deb713dd0a9aba0ff9938b3d69f71d1900a27ae79e53b0d0dbb7f89a0559c53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Filesize
6KB

MD5
b99abb3fd9bc3db28b270e18a80c7372

SHA1
ff72f69f7668556973108e4a68296c535bb222e4

SHA256
cf73e0f4b0061294795db93cebd5b71b37c1b758475bf2008f0d4c597e09e433

SHA512
e936153c2e304b92bb0ad078b3fb067fa8b29746d115de37d1d7248dd486a9a48b80d8c520521adc537ab9213c87f927bed8d81da1c8b74de8ee808f469cc656

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Filesize
11KB

MD5
a5e1acb2eae95b419a73073c5ea51ee8

SHA1
39f0e78bd490df17803b6570feba9f3e4268dae3

SHA256
d1d2da2b99888fd3603038f59d8c7bd502284027e554f80e42073d705828dd7e

SHA512
c06db2e1d5866cbe120ab99a53846eba5466726e1c8a13c2ff31323a3fc7abc69a9360879b8ef4f1ad222c13db601c389569c23efb3e4c89331b016e3e824c66

Download Submit