hxxp://oponas[.]com/redirect?publisherId=5gg8kvwqdn34zxyn&market=de&placementId=c5987c352bc48a5794ec0886b963808a8f620d03b468547a426b9d2eccd2d300&placementId2=d1c1a0d8-5013-44a5-bbbf-0901083e071b

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
22/04/2024, 08:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://oponas.com/redirect?publisherId=5gg8kvwqdn34zxyn&market=de&placementId=c5987c352bc48a5794ec0886b963808a8f620d03b468547a426b9d2eccd2d300&placementId2=d1c1a0d8-5013-44a5-bbbf-0901083e071b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
2336	msedge.exe
2336	msedge.exe
5340	identity_helper.exe
5340	identity_helper.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe
4596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe
2336	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2336 wrote to memory of 4868	2336	msedge.exe	87
PID 2336 wrote to memory of 4868	2336	msedge.exe	87
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 4908	2336	msedge.exe	88
PID 2336 wrote to memory of 2488	2336	msedge.exe	89
PID 2336 wrote to memory of 2488	2336	msedge.exe	89
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90
PID 2336 wrote to memory of 5048	2336	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://oponas.com/redirect?publisherId=5gg8kvwqdn34zxyn&market=de&placementId=c5987c352bc48a5794ec0886b963808a8f620d03b468547a426b9d2eccd2d300&placementId2=d1c1a0d8-5013-44a5-bbbf-0901083e071b
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd41ed46f8,0x7ffd41ed4708,0x7ffd41ed4718
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2960 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5732 /prefetch:1
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,1806608304707114001,3802944263618224065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
120a75f233314ba1fe34e9d6c09f30b9

SHA1
a9f92f2d3f111eaadd9bcf8fceb3c9553753539c

SHA256
e04101215c3534dbc77c0b5df2e1d1ff74c277d2946f391f939c9a7948a22dd0

SHA512
3c4eb93e425b50e8bcc1712f4cc2be11888a0273c3a619fc6bf72ccab876a427158f661bfc80d0c1e47ef4116febf76a3aaa31a60ec662eae0e51c7f1d3d89b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bc2edd0741d97ae237e9f00bf3244144

SHA1
7c1e5d324f5c7137a3c4ec85146659f026c11782

SHA256
dbce3287c7ae69ccbd1d780c39f3ffa3c98bd4609a939fff8ee9c99f14265041

SHA512
00f505a0b4ea0df626175bf9d39a205f18f9754b62e4dba6fbb5b4a716b3539e7809723e1596bcfe1ba3041e22342e3a9cbaad88e84ce9c8c6531331bbc25093

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
552B

MD5
e9c86c037fdf241ff0c6888b68667aa5

SHA1
25f00c7721f8e5d06c5cf74631eb2dcda0b6a390

SHA256
d273d2e20e6e574825380307cf6e68e1e94647194c4442c83da22b9d645cb51a

SHA512
b82d9b910e1032c56cda69cad0fda49e48dc056d68ab8476b8b72111cac068f759c05e89a8330efa257f94962f1e2282a2427639f80eb0d9070d1866c4652d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ef183eb4d682836cf13227cb438db97d

SHA1
68a47e13672b5d8c97177c0b6b41146c658092eb

SHA256
4895a84679c396d1de88517b68f034330210c45fb2e28090f4f297608a27b961

SHA512
cac2c53fdbe13562f372fb3c355ab3253ecdf122fd69c4fbb5e632ffc6ad5bbc68b9ee2e424e62cd7f0bd1f8dd34997ae9620155ea490f02e6f995cdf08a93fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4f234b5a100727a537e4772541c73b6c

SHA1
65b6647c90a3eea8b0738e8412f4b8ee8c32bdef

SHA256
b8ce454cad7efb2ac0d0fb817462832710761c6645094b79ac1991288dbba339

SHA512
fb3206be95c5050e8448a37d35be2d6d93980b3ee121b17acb21cfca0b72db9b4ba5afd5f73ce9f17e42f4ffff96bb8fa839f3856d07848a6f1cf7efca48054c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f6d7d9f60a95647f8800a1597e64e897

SHA1
2a8e02b44f73737beb42b4aae2de9866a9317f51

SHA256
b30de4f73321d2e2f3ca2c6634bb80a30de146b6e8191bdc072bc661fad859e8

SHA512
bbc67d8189cddea959a0c3d888f4548eab35e3e04c007b6768156a6110a4935f0ef9c7e1932ac7688f19564a6411603640a716062ca2d3e3f89326478f7d355b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
17f1dce80c882101646e3b5e18a49d6f

SHA1
19b106e3c432a06598ada63610349b71e52c1513

SHA256
637cdfb094c8959cd3cf78908a5afa33573ed845e1308b488fba09c048a6bdb7

SHA512
371e2bc0e5aed6549f7dad7d4df9dfaa342fcf19e92b50eb1c92c6e464ed9bc65de4d49e1db078d57c86351cbe873b6bb91330cb37ef2ad78a19a206c511941a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e8fc44e9f466fc189e2e77e776d2254

SHA1
038d934d08d5581162f5b47ecd8b3493ac74a7e6

SHA256
3beb59e63033d606e2f23fea49addfd4491901ba503ec12daaf137094d7f20a6

SHA512
aa9e8132c90a439f069b1d258fcc8092403d085d7ba54b9e7e23f2202112842d4f3e794fd530a874d6b17579c78f1e13fd24787acaf63b7df6c142985e2838fd

Download Submit