bfad87ee8b3cd0bfc282ed73162c28e63495287738bb3d99b92ba0f75a4d58dc

Analysis

max time kernel
148s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
13/03/2024, 23:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c725a52601dcd253b147b5423574fe3b.html
Size

2KB
MD5

c725a52601dcd253b147b5423574fe3b
SHA1

70781846c69ab60c1555003f0015bc4d57810943
SHA256

bfad87ee8b3cd0bfc282ed73162c28e63495287738bb3d99b92ba0f75a4d58dc
SHA512

64c33881cb5e16a5151e954f95d4ed4548212eca5f0d04d7a4a96c6ecd7d4a9312246f96201fb8136bcd8f17dac8759a816640704fdd2ab218f3dde3bfac75de

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3400	msedge.exe
3400	msedge.exe
4844	msedge.exe
4844	msedge.exe
796	identity_helper.exe
796	identity_helper.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe
4844	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 2688	4844	msedge.exe	88
PID 4844 wrote to memory of 2688	4844	msedge.exe	88
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3780	4844	msedge.exe	89
PID 4844 wrote to memory of 3400	4844	msedge.exe	90
PID 4844 wrote to memory of 3400	4844	msedge.exe	90
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91
PID 4844 wrote to memory of 4992	4844	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c725a52601dcd253b147b5423574fe3b.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3fcd46f8,0x7ffd3fcd4708,0x7ffd3fcd4718
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3868 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,17528828316359621232,7568861727904691065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1796

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000002

Filesize
198KB

MD5
06d38d9bf028710762491328778f9db6

SHA1
83e1b6cbaad5ca5f6dc63453da324f8df28de193

SHA256
91558d69c027808e375e11c80166dc6ba245fbcfce715c9588decc55b4a33dad

SHA512
b197e5f92add72688396a07246ee9842a3b0de36508aa57f0254531cb109c77d0392e00ea28e006f9fbab1b8fee9b333998946de47ca7526b631e8c810780781

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
24KB

MD5
b82ca47ee5d42100e589bdd94e57936e

SHA1
0dad0cd7d0472248b9b409b02122d13bab513b4c

SHA256
d3c59060e591b3839ec59cad150c0a38a2a2a6ba4cc4dc5530f68be54f14ef1d

SHA512
58840a773a3a6cb0913e6a542934daecaef9c0eeab626446a29a70cd6d063fdb012229ff2ccfa283e3c05bc2a91a7cac331293965264715bdb9020f162dc7383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8fd9f9abd476a9c3c3b2b3e9d2ebd778

SHA1
36a1c237461d2fccfc43c34757f4fe4f37a0ef79

SHA256
0b3e3ae096e7eeab73964d81b371bd819eabfc6c46d766bf5036313a6b53c70e

SHA512
1cc64ec5582968b08c15f8e4963f4f3dd6d3a9f8093299ab57e45a0546e3cd0b602c6281104c0327c76a4990ae651a236e844f30a90925ecb018cbd2dbf8d398

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2e2b4822fc2da9d438630394ac1add58

SHA1
09ab753df6ee557c873d204083e939dfa5bae3e8

SHA256
176a8a0062f958755020bf92443b4cffdca10d3019a7584d8ddbec53c59b8254

SHA512
d68153e043f7635c6f1bc4a58f62fbe1b2bf1aaef9875174c2a4c50e38e8a45ebf339f4003baf6ff21f40493bf29250f7e92f32222d13b2af00a649a394671e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
80902057cc74f7492743f4b2d26b6542

SHA1
c4c5c1e1a9fd43298b32299ab55425fefbf9b3b8

SHA256
66b2b3b4c1e86a061e2a19400e4a199f793c2180d5b1cf50e58fafa4fb718071

SHA512
5c5b5ec1a3b9ee3817008d3337ece71ce75cc297dcb9c0ab4f0655f578e8ee756d90aa87d87aeca58fed8b49d64e88131ede1c48efcfb504b40d2257c1591239

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82a9a10a4ff1a81b0b9ca7893286780a

SHA1
5837d232b72d2b4a952e1e823a293bc9ad60b331

SHA256
f55e4bdfcc94991fca1f7177878165fdc0dd838753f4040c672dc73faaeb6c1f

SHA512
59ad1da67067eebaa98028dedff3baac903c62418f1f9bd7d7a8f218180e0d27d36efd98665c97ce240bf2ff66beb968f6282b8a3b75b71425a168e452af3742

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
32d8683f38160bdec24b2a09c8196d24

SHA1
2f2615430936906ff4b42e73effa5c74157dc95e

SHA256
efd901d74e2fd1741b440e58d63bbdfdc938690d23bdc99211e2f92eddc920ef

SHA512
ce799b3a703d1e2d82b6d927558178f333b34877d7b21eb0ad147044b7db063d071faa56feb77e1828802b6b13f6f29e61de06c113444a250a0b896fc4f7d3ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0aaf1ee820b90a40867d5c389845c07a

SHA1
2c39c953d8f4246f6c7ee77cf46fca38146c611f

SHA256
aa85feb8c6d3bc0d39cc0132d29c83434570b5a257ecb0201ba0588cf38c8ffe

SHA512
43408207c8c20c47fe5df39829cea65408198e7d9e0daab70f8f25705e34d0dc10fb4b0412d9440baa1046f48a08c7cb49db9d4cd3a564a4f22b70425700ca2c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9e169f14221b046ffb1b06e99ffeb871

SHA1
e78aff7fccae743e26c5c1e2e5c01b22b2a3149a

SHA256
1cf7d8d6608f954214ac7d54de7a347912f7881868d734645b0e13610ff7cdbd

SHA512
716ebe26d72d46d80ec157c94adce494f3936284f8e0026cd7f49e1f2845b3eb76405ad5ef3bbad1f2fdc64294a414140f049e026a4c2b58f78457e17c141523

Download Submit