hxxp://instagram[.]com

Resubmissions

17/04/2024, 19:38

240417-ycr5wacb63 1

17/04/2024, 19:38

240417-ycgzxacb49 1

Analysis

max time kernel
160s
max time network
170s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 19:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://instagram.com

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
1308	msedge.exe
1308	msedge.exe
1244	identity_helper.exe
1244	identity_helper.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe
1412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe
1308	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 4640	1308	msedge.exe	81
PID 1308 wrote to memory of 4640	1308	msedge.exe	81
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 2132	1308	msedge.exe	84
PID 1308 wrote to memory of 5000	1308	msedge.exe	85
PID 1308 wrote to memory of 5000	1308	msedge.exe	85
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86
PID 1308 wrote to memory of 2852	1308	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://instagram.com
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc981446f8,0x7ffc98144708,0x7ffc98144718
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3568 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,4690375224092702225,5902508965458452229,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3424 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4896

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b1931878d6b8b22142fd7fd614add5c

SHA1
0e20ec0bec5a9fe3b6666c3009626f0420415bc7

SHA256
d78e49cf9c940d8a407fca2338e30b754e4579c64e88932c46c3871f62c15904

SHA512
1e7a63ff7340719736560277601ff43f30937dbd4a1fbacbcb0d72fa708216692a4bb4ba658edf227b767975b430fc94e7c4f0b5dab29bef9483bfcfb38e1cf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
70ae4bf8f75c69610c1d00131c1ec28c

SHA1
eab92c184a3b655377f375b1b25ef85fb06c7130

SHA256
9f46453862eb083e85697631455185c0ead19ec86c1ae3d15274c06c9a38731b

SHA512
29299dbc0114f01525bff67ec421a28056905e8f5d21f00502554f446883b6086f8b9a2c27a591f364077da17c21438910b8dbf163a59f6f80272eb7d5f05c68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
3ba7f6ed608f0064be58482bf13d6de8

SHA1
e08345e4f78a2c88c31d1ac53ddaa9e431ef85cc

SHA256
36fb1e37f6a6cde3f9d1a12117adf1d521436182ff741c68b55304ea66544a5f

SHA512
3a09b0b4eea8d309a5d3d6394390c9e2616c5a414ac46db50313fdfe576aeb29d5d5c444ae2735f97d2872328ce7196cd793c70a50c8fbfe11131f8cf3e6b30d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
336B

MD5
2efc7c9859ed712ff8518bdd5dad9a7d

SHA1
f98c0c14f000802746f110ed38150ba8f8718f44

SHA256
5d9bf8fbf394251d921eedb4336f2b2a8db0b075df63c00232e363c7294edd23

SHA512
1afdf673d08e4e0fa45d309efdacfdf2a08e397d92538d458eb02edbf68c30ee5443b7fd69c7889727b13b6ed24e305884ce92c3c5775315442457c667d759d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
55a1da9f79538b38c4ded0e14d2d443d

SHA1
209900d3368888bc3aa3ef3794181ce3e17f5892

SHA256
59d07ba3bcb12dbd525df9c0adec8e8bdf85f661ef8afe6d1e3a400163e37c0c

SHA512
6fc51fafcb5d55d5bf11f2dba9cb556ad04a4ce4c260b3490d5737f2d468c72c2e7572989322732f1b8211268e4a5d4ab582b8bd07c8a76932837057cce3d27d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
adec0bf9f9bc87fd8d34dd6f6a132ba0

SHA1
02d1a38c5f6027b6eff194fb64e9f707c4a30ed2

SHA256
4e1e1b161463aa514624d6660066dd154a5d6e409c7d50de854532946e658a1c

SHA512
431819cee0ce4f30df6239abae04598d7cbfac8b054b7cd1628f908c19367f0798d6706f8c20f56f229aa09560dd38c5c5ab687b6d9d93c786ac3d7c97d56012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
a4f0790c69373a8bff2e432f4f174f69

SHA1
8c2f93e58f22e9e14e516c3e9d20653e03a87c52

SHA256
e5f86c645c6d70eb4a767235526f2491a1ced33bfa9680716d5920e2e637379b

SHA512
67429cce2b63651e11789dd9bc4a3716f5dec2bc3bb69c250d7d894430eaca797d6d774c450faae0cdbed6a650c049b4313d428d2086d8391225d89c35d8bfd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
d9177001562ac07681553739012fe2e7

SHA1
3239557d6e3d5da138b7248c87d38dd07bc052ec

SHA256
2955b35ee5383aa42f1ad56cd68d83b634710f7281ca85d9934c03edbf46eba4

SHA512
865c0ba4b6b3bd6266d2b073227b514b1a14faa80596d4f2163415b64c2487963b7573691bc2161b8edd703deb550b70ae196996555911c3e9ee7ed548012c0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
705B

MD5
8d08c3ba020a69e59fc6d16b6ee0a237

SHA1
4310cf11d53f1bcd0dbce2d7346cb2e6fd530df4

SHA256
a6eb5d837783938a4979dca33df5cb26566c5b710e1e0e8fa8050c5696b84b22

SHA512
e6e70e05de11ef3ce9becaea9cb2b44fae087524446758972f6ec86a7eab7b2331eec32d89a161989f55c940fa3445a21abbd6cb8982abfb144a41ddfb393f55

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58605b.TMP

Filesize
705B

MD5
49b764c9bcd029fa32afb9c701651757

SHA1
3d1d3ad3bbd76967c3241da8b631201e092254da

SHA256
3144e7dd322f1df4b71518edb24d6c5eb6921b42ec7b0c5b7d5ca1f43a0f7eb8

SHA512
56ab9ca5edbcb0cf4a9892bf0aabdd14fccd0d208f0084e02b31745b24d8d99d9a735e5748fdd8a3cf7a1e0f6a2586f332c856cb0fafbb159e63e14c054fe941

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1b33ee9fe2cb766e627c6fa2e0a5dc42

SHA1
40d344f3a2b3db31d14d090ca0413925e2b6cbcd

SHA256
0febbbd7488c6775573326a907496d38425254f52c930cbd0bca664e4b54b62d

SHA512
9a53d223048e4f7bc7a85b8121c7ea008fe04329d794a7c88a458a3b7d1c94e7811505a0310b8e0147eab155b0094ee0e108f5673ec2dde400ada290cdf420f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
33b3320b29bea7be6d12ad9fa0691c45

SHA1
888062d9aeca6e90691b54f56f9372e218634644

SHA256
d01fdd794152a7aef6ae1bff1f1693caaeb3bc41c413ee1276fe3ef27f4ba2f6

SHA512
730fa95d121806d9544e8459ce1e8623a330e6f881aef35a4a0a09e15f2f05b7a41d6200bf6c4bb83a105aeb4b3e8646822f5168603a73d30172cb730e9ba73e

Download Submit