hxxp://vhxxps://github[.]com/shehatesu/cautious-pancake/releases/download/31/Software_Launcher[.]7z

Analysis

max time kernel
46s
max time network
47s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 03:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

http://vhttps://github.com/shehatesu/cautious-pancake/releases/download/31/Software_Launcher.7z

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3558294865-3673844354-2255444939-1000\{99662C18-8318-49B4-B39D-8FCDE558F7E3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
1480	msedge.exe
1480	msedge.exe
4104	identity_helper.exe
4104	identity_helper.exe
5200	msedge.exe
5200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe
1480	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1480 wrote to memory of 4828	1480	msedge.exe	83
PID 1480 wrote to memory of 4828	1480	msedge.exe	83
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 4324	1480	msedge.exe	84
PID 1480 wrote to memory of 2028	1480	msedge.exe	85
PID 1480 wrote to memory of 2028	1480	msedge.exe	85
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86
PID 1480 wrote to memory of 2764	1480	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://vhttps://github.com/shehatesu/cautious-pancake/releases/download/31/Software_Launcher.7z
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa7bf346f8,0x7ffa7bf34708,0x7ffa7bf34718
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4980 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3408 /prefetch:8
  2⤵
  PID:5192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:5584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,16785592773475856162,9217186315185737395,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:5664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4016

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
2KB

MD5
1c181a9d6054e17f79da65d3fe3c28a6

SHA1
116c533f7b1fdabb396c489771b52ebdf6a0bc34

SHA256
e4d0cf79697429b85c247bd15bd42f6cc31da1dda5c741ee29987ecac3e2871e

SHA512
eff0efb9bef44923e1bec2988db7c499271d47dbf0f6fea32b649498257bf775c4e23e233171f1b4b2b2b331963b48179e25558b4f38b88aaa40d11aff207861

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2be02aaa829b889a70fc1b4171fe6ea1

SHA1
7fd976950d5799bd1aef0242b583f418aec7c51c

SHA256
7ff1de47ddadf9009f23d5085c41bda8a7b00f26bbc2650c5b0d958f00f19f36

SHA512
86af664e79bee834bf39059dcb0e4ed5ea3dd5b3605288f9edef0212bc4d5a9c9d2f9e035eae559f499bdcbaa5f47fc1b43c33d192c97d7fb2cdbd04c79fa026

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df406da2617c15e1f8c20c04694aae21

SHA1
1b1c464464f53f495160b5d1ce2ab59078798699

SHA256
3459eb87bbae3bdbd0ce519d9f6a76a310a3c9c6157c7a33c55804ebd318642f

SHA512
3a20df492a92164677cf2b537aef923ba1cddc5e6d6786e962701a5eff873b7bb3d9ee5a2d40cc6ffc75bcae86fb045e3f3cf3658f4f28404caef0def84c6eb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
39edc6fa0df01b400b2fc9550d127e14

SHA1
2e488f786be51a5622b1d9de47420574d0f9bef2

SHA256
177d02f6e39a6f22b582cf91d99a65492ee8e5f23de307d456bcf0fa7b03b9ed

SHA512
661a1e0e5a9a2d082d0226f5562c9c863801b33c5b999c4b94bcb4a329521409561605381ec9799be5866f1888fc5d3721455a04bf69fefe295a06e2ae50b9e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b0847e87e2bbcf2b915e3c834856f377

SHA1
bb60e36d78c75cac1a453e5add96b60760f6f55a

SHA256
7ff2c674593ad9cfa4c7e1257a6aeed4467b5dc663c34ee2135877ee0077485c

SHA512
7d1ef346b4e2126d2bf05fc9f16dd0d10a1f4837468ab5440e4e9b0a5f60967795508b8c41fdab7c13adc57ba171be9a8af03340d431429b5dbe9cef69169a3a

Download Submit