hxxp://example[.]com

Analysis

max time kernel
329s
max time network
330s
platform
windows11-21h2_x64
resource
win11-20240221-en
resource tags

arch:x64arch:x86image:win11-20240221-enlocale:en-usos:windows11-21h2-x64system
submitted
09/04/2024, 15:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://example.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2348	msedge.exe
2348	msedge.exe
4608	msedge.exe
4608	msedge.exe
1568	msedge.exe
1568	msedge.exe
956	identity_helper.exe
956	identity_helper.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe
3724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of SendNotifyMessage 18 IoCs

pid	Process
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe
4608	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 668	4608	msedge.exe	76
PID 4608 wrote to memory of 668	4608	msedge.exe	76
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 3280	4608	msedge.exe	77
PID 4608 wrote to memory of 2348	4608	msedge.exe	78
PID 4608 wrote to memory of 2348	4608	msedge.exe	78
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79
PID 4608 wrote to memory of 3076	4608	msedge.exe	79

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://example.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffd76a73cb8,0x7ffd76a73cc8,0x7ffd76a73cd8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1928 /prefetch:2
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2684 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3156 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1432,10393524022195204047,3209224477441540005,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:3992

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2356

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
96899614360333c9904499393c6e3d75

SHA1
bbfa17cf8df01c266323965735f00f0e9e04cd34

SHA256
486e4b4bb11f664c91c675e73cfeabe53b5009ae719459813be17814cd97e43c

SHA512
974735b40a9f92b40a37a698f7f333590f32ff45633c6e619500e74ec274bc20bf7dbc830b1685777b714d37a3ca103d741ee056f4ff45ef08c07b38a7895df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
19a8bcb40a17253313345edd2a0da1e7

SHA1
86fac74b5bbc59e910248caebd1176a48a46d72e

SHA256
b8024fbed11683ef4b53f5afac0ff691025b7eecca0f6a95737da1585558227e

SHA512
9f8780f49d30aad01b28189804329aeca6ad2b7ffb6be505d40bb1af7802bb62622f518cb1c43a5815bbbb46638f6c52aead3d68f14fa957d18157edb42e95c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48dee2d3-a47d-45b7-957c-8ad8b95a105e.tmp

Filesize
5KB

MD5
ae028295f07e05bb5f42a732dcfe5e2d

SHA1
519ee9901f9c43cb3dd45fafd8071a8706a13dcd

SHA256
2feff4cf8454c617a639387afb140b1d649df1a64147bb51f78b9f560ce893ec

SHA512
4842b4792d94dbcdc3d2aa45f499349c260b6418c7ea3552b4cb58d0d638dd71798465d03e30c1424ddfc6e3d9390c9d0147e4037cf7b4e1e404ab305c21d1a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
252B

MD5
c91b786a0a43772014ec184a1ae859ce

SHA1
da576c8662371f07b884cc8c1dedbe8ef3206557

SHA256
56e94c4f6eea71d6ce17b1c45088511d270a4f9310466ed7413148f92282285b

SHA512
e1257e3df2d912e0925910fe68731a515de23e93f3444e0bd0d49fd01e50fef1abe66c41b6a06f969b0c3b682d6c7149d33bd801779be5cca0537f93c00ecf44

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3fc9bdaa7e84a14b470b7bb2775d5d48

SHA1
cf754dbb996530b7e231509ceab87ac607eca85c

SHA256
9a15b2185c4fd1268c02645efcb62394b803096a236a1f6fce9bd638f49847c3

SHA512
c606bf2f8d3e6e60c3106a787c74be5c45bf2465ffbd7165b4441d44f52c1fd768c49e119c0502fe55c0f8c6c27eab3ca29f79445a2c1565e2f8c30833f5dda9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1fb513c22a0414e2b6ec69c29aeac25b

SHA1
abe657ed26ebfb3243a260a4f11595f22ef77642

SHA256
a5e0de0daf1dc643c38bd773c947a63eb5c43749eed005c7b20c979f2d59dd2a

SHA512
e8c4a14d93670d49ae9ae97dc2bdd55d9e5c8d06eda858b3312b395fd312d2b7b7ab2edbaf38bba7e512e03c5ceac24a9baf9ea7e9202eb67a1863788edf310f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
185d61aeb84b288450add0c1def8b0f1

SHA1
9b3f88e41e5b8172fee2cc319d3d1290b812cb86

SHA256
9bc6e0a958dd180752fedb85c967c5cddfa367d96eaef613160bbd9a3dd21c6a

SHA512
c09701554cfd841a125aa3c8364e6902b9c2430fe7c6def936cf92957afc584eabad1703842fa77f2c3d8db1d7c96dbd40bac112acf5ca4d875e2e1df588f0e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0e8ade0f78d39e2381a34ec389e0a525

SHA1
c764dcd27e14516fe0e83554569a0c648f853a55

SHA256
30e7a651f6ba2a411b75b141f1f2ce0e4a5a4c4b6eae7063e0f81f1f1b84906d

SHA512
6acac28c86f677bbe6cb00f99917fda2e01a5f31496acaf8f178e981de6974ddc69f04743281964b0e537ef910977b23e6faf895448eb3813172c7fbb3171483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f3d70470be359a0efc1fd7bb5fd26125

SHA1
5e09ade96349c0cf78b3e1b497872c79572c8b52

SHA256
6c342ea6ee0b12f48c38dcb9a755d3465f64437a4b6613751d48c38095a017dc

SHA512
daf0a80b3d502f9ec711f4bc5465412ce68e13d29a93bb3a28b2a21ee4787cc08d831a5ed27132fd5885515ba09c47e938e14d23a21b64420a495232b255d394

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
437c322e09f9b8525f040ce337df38dc

SHA1
dc638d3436e83b911beb4e36a4fa0dd4477733d5

SHA256
d1a5cd286a880619331e86c637b90d7a4969f79f19b038159447b0dce2bebcd4

SHA512
283844767d8402f8f5859782e980409b3d1c1575950b381012ce7b6459a48c1921e6959642d2596fa90e2b5220b74ff32b746c8cfaeb97616035f10eaf5a8186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a9e015e25332733c064b7b4ace615fd0

SHA1
81fdb4bb69478247b63080b91c3f28273ab2edef

SHA256
c819514d6e00566b196c46297bb2fa3721b60d6012e48e73bdcd624b7f4cc361

SHA512
2f3deabdf4070a8115be058bb874f8615d47e611e73ae899e1faffb5d83f9329e707b5ff27701e9076b97567caaed294caab035545e225ec1ee4a87855456e68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4a5d13f7372a8b8b5675e0bba1bf593c

SHA1
ee645a6152b886567c111ff0c563988a78d0ad48

SHA256
392db70ec7bed64f17064963f9fc5f78bc061c6c6e9bb886f660642b54a91e58

SHA512
75d17757736d47a54ae80ffafc79e4e4ada2dc111a333294ec3dc3595bcf9bf4391516448be2eba822f61884f232bd7e6392d05352a1c03726ce0cbac560d2d8

Download Submit