hxxps://click[.]convertkit-mail[.]com/27ugn8nw26t9uq8wxlcpfro9v444ug/58hvh7hm3o0ekvi7/aHR0cHM6Ly91cmxzLmdyb3cubWUvS3RLRllDZS1tRi9lL2Rib3VuZHNAaGlsY29ycC5jb20=

Resubmissions

31/05/2024, 15:12

240531-slj8qscc3z 1

31/05/2024, 15:03

240531-sfagcacf67 1

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
31/05/2024, 15:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://click.convertkit-mail.com/27ugn8nw26t9uq8wxlcpfro9v444ug/58hvh7hm3o0ekvi7/aHR0cHM6Ly91cmxzLmdyb3cubWUvS3RLRllDZS1tRi9lL2Rib3VuZHNAaGlsY29ycC5jb20=

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
2780	msedge.exe
2780	msedge.exe
4564	identity_helper.exe
4564	identity_helper.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe
1440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe
2780	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2780 wrote to memory of 2832	2780	msedge.exe	81
PID 2780 wrote to memory of 2832	2780	msedge.exe	81
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 4932	2780	msedge.exe	82
PID 2780 wrote to memory of 3144	2780	msedge.exe	83
PID 2780 wrote to memory of 3144	2780	msedge.exe	83
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84
PID 2780 wrote to memory of 3264	2780	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://click.convertkit-mail.com/27ugn8nw26t9uq8wxlcpfro9v444ug/58hvh7hm3o0ekvi7/aHR0cHM6Ly91cmxzLmdyb3cubWUvS3RLRllDZS1tRi9lL2Rib3VuZHNAaGlsY29ycC5jb20=
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb014846f8,0x7ffb01484708,0x7ffb01484718
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,6638640160485656293,7623074863838248397,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2656 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\935d4000-708b-4ea4-8d4e-082a5f655ddf.tmp

Filesize
5KB

MD5
c517d07d57421b15902270a779cc8003

SHA1
3ad747f2f594f7569192c9695c3edfe884bd21cd

SHA256
2b58cdcc9f85b0491cd3ac636d932079c6c16777ce81748cae56684485463d1f

SHA512
cdcfdd88a7b0cd2946d62114f7c95002e7d35bdf3ee50d2c681b724fda9ab43a3bf7f28c2920207cdadacfb3c587f2ab46ccca0f18d345301ab1c25dbe188c64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
d25dcd4a16d3173d0a6b81f4372c3c83

SHA1
525b21c11309a1a90892dec157894ea8dd7d58a3

SHA256
88b4be9d2fc69fdf6ad36d1a9c869a8bec92336e8790bb4cbf293ce7f38d406b

SHA512
9f7b5df48c22070c6427d8ab611c292a6ca40fcf097985308d7e123df84f922b02b2eaf16326ade4ea81686d94324f55b59c9a57ef796bb5be270f19bdb38545

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0b9abfb26f949cd5f236d573bc65a93f

SHA1
2f5f877d47654e96c934bd4d9520720330905045

SHA256
8cb46b16ec12d7df74764104179dd42bb57ebc968d1c26c11af4092a6c70aad8

SHA512
396cf1dd2bc5d4073763381cc15dad8ad2e9a4fdd41c90d881d26a96a3b24ae557e669b3aa8ad9589516191eeb2fea463c70ed3ea52b9bf0d77493a71a8331a9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_insanelygoodrecipes.com_0.indexeddb.leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
53a5dc4d16c93d2d3dba5f842de029af

SHA1
f9bab388abafd21bf675e140d58a6bc4a16a23a9

SHA256
5861c6f83ba165fffc6dc46b6efbe2ce522a8004d26978c1e67d008457dcdef9

SHA512
2459a786fb567c6a8b11bff97bc5cabd2dd6e2b9c12406f336e40a6780bc8518f46c4572ad51bcd5e47a1ffc881f45bc6f186f8bad7eaea4af174b5f690e585e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
388156defd0ed7839449538600db2c47

SHA1
fd180ea8b312c5c6f802b1cd060c3915963620f9

SHA256
0e9ce9dcdffded0afe45183de2c2d0908777d0c91bdcee39d38a9d398c8245f2

SHA512
9e15f9226260d31b91f37eb3fa14cea3557e943d4d44b7aef39425cd758c81defa2f1133ac7266a733e407b8668c5d3822244b26e67afbd4acb4bc14c8ec4b2e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
96B

MD5
073819e9d100fc99ce4dcdf942dfaaf6

SHA1
05747e4a32f091bee6e638384fa0cb4c1ff6a6e5

SHA256
fc427f4fd2f1582ecf34a7e6b5fbb6f7e8d148fcf4cf98f7d523924890a73d2b

SHA512
6f9f4a66e2394b5e34ef3abd54c97b1d9be4fa5cedddbf3f4e86865528803353aeec90815e508afd10873322cc3cd1ba72a0ec2ddf0cdc6d5845e0012b8738b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a47d.TMP

Filesize
48B

MD5
4eab023e0bc094c9dac7d21533a39bcf

SHA1
abbdbe5df1b34d601aee1ce8a37702ba3d0c001f

SHA256
bbca678fa1e78ac98b645dc8bc0b6eeca8888d9cab0be811fc51bac71e262a94

SHA512
a1d3185634288ea4a4b54428ed473d3af830ba769d2eb0279f8fb9e5e9d578dc06a62d65bdb10f20d31c1a7dc3ee82c0ecfe1ee43e1823f253bd2661c8b43d54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
af8fd2b919ccd30fa5faa74b0a491e5b

SHA1
f6b4ed22d901a7587c98e9dacfb2778fb005f535

SHA256
a41728edcdc3f9f91e9835e5dcf405e3f335fb4b422f6416ed7be281bb2da209

SHA512
3173223315a0379da3beeb8f52bb3d6ea20846beba4416f59a326bc5cc596332277020cb4d37a244791d35034f8d524344b35cd1f64e956ea744cf3427980b98

Download Submit