hxxps://www[.]youtube[.]com/redirect?event=channel_description&redir_token=QUFFLUhqbVY3b0FVY3F2bFFPeDA3TDlCRFR6cXp1UGF6QXxBQ3Jtc0ttdkF4NkhTWGZielhrcFU0MTA0R0pRMzY4cThzRWRGOTRrV0l4M1pYMTgxLTFuOTY0YS1vR2JBdS1maUhZczJwMTkydjFlVmhtNG5WSFVzVnREYUxNM0VDLXpqLUpOM2U4NkxjamhZU3pIQURERjlRSQ&q=meetmehere-lisa[.]click%2F

Analysis

max time kernel
73s
max time network
79s
platform
windows11-21h2_x64
resource
win11-20240419-en
resource tags

arch:x64arch:x86image:win11-20240419-enlocale:en-usos:windows11-21h2-x64system
submitted
19/06/2024, 20:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbVY3b0FVY3F2bFFPeDA3TDlCRFR6cXp1UGF6QXxBQ3Jtc0ttdkF4NkhTWGZielhrcFU0MTA0R0pRMzY4cThzRWRGOTRrV0l4M1pYMTgxLTFuOTY0YS1vR2JBdS1maUhZczJwMTkydjFlVmhtNG5WSFVzVnREYUxNM0VDLXpqLUpOM2U4NkxjamhZU3pIQURERjlRSQ&q=meetmehere-lisa.click%2F

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
1436	msedge.exe
1436	msedge.exe
4048	msedge.exe
4048	msedge.exe
4704	msedge.exe
4704	msedge.exe
1012	identity_helper.exe
1012	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe
4048	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4048 wrote to memory of 2716	4048	msedge.exe	78
PID 4048 wrote to memory of 2716	4048	msedge.exe	78
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 2816	4048	msedge.exe	79
PID 4048 wrote to memory of 1436	4048	msedge.exe	80
PID 4048 wrote to memory of 1436	4048	msedge.exe	80
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81
PID 4048 wrote to memory of 3672	4048	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.youtube.com/redirect?event=channel_description&redir_token=QUFFLUhqbVY3b0FVY3F2bFFPeDA3TDlCRFR6cXp1UGF6QXxBQ3Jtc0ttdkF4NkhTWGZielhrcFU0MTA0R0pRMzY4cThzRWRGOTRrV0l4M1pYMTgxLTFuOTY0YS1vR2JBdS1maUhZczJwMTkydjFlVmhtNG5WSFVzVnREYUxNM0VDLXpqLUpOM2U4NkxjamhZU3pIQURERjlRSQ&q=meetmehere-lisa.click%2F
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ffa8fb83cb8,0x7ffa8fb83cc8,0x7ffa8fb83cd8
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1956 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4392 /prefetch:1
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3932 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5664 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1944,7117661749705659275,15648673368825276633,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1364

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
1⤵
PID:3916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ade01a8cdbbf61f66497f88012a684d1

SHA1
9ff2e8985d9a101a77c85b37c4ac9d4df2525a1f

SHA256
f49e20af78caf0d737f6dbcfc5cc32701a35eb092b3f0ab24cf339604cb049b5

SHA512
fa024bd58e63402b06503679a396b8b4b1bc67dc041d473785957f56f7d972317ec8560827c8008989d2754b90e23fc984a85ed7496f05cb4edc2d8000ae622b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d0f84c55517d34a91f12cccf1d3af583

SHA1
52bd01e6ab1037d31106f8bf6e2552617c201cea

SHA256
9a24c67c3ec89f5cf8810eba1fdefc7775044c71ed78a8eb51c8d2225ad1bc4c

SHA512
94764fe7f6d8c182beec398fa8c3a1948d706ab63121b8c9f933eef50172c506a1fd015172b7b6bac898ecbfd33e00a4a0758b1c8f2f4534794c39f076cd6171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
956ca21b794cb2c20d6334eb03c21a2d

SHA1
a37333359fdec92594851020f5275cbfc7345c11

SHA256
e4214b5028a5d353858eb94bcdf19b2da561aab7039fd829143b68e059d283e6

SHA512
21dd6ae580403aeab87405a7e62c35d9caefe9390f84e828f94a0c3c0d3cc25a2ba17ff69deeb3fdd8654a18377eda67842b6eac6ce6ea41decd01e9f3569557

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4a250b5b26c25316470b35e6cd435261

SHA1
198231f25acb487b197b8a81a0a3a242c30257a4

SHA256
f297e8d16dbc5b32532aa63a20932c711d1984e77e40b233046510d5b21d3054

SHA512
a082b7d34636b3038dbcf6eec607859bd766fad2143c8849157382a8f62b7eee1fa1a0d7660ba1275a7f4984fcc4e26f94feb246635988f494a3fe174f5b122f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b3b1cada-2d36-4d60-9a9d-919834e16e4f.tmp

Filesize
6KB

MD5
7b9b7ee9d111e27d4837924f4cd8379e

SHA1
7c49de66982d9b0716623d0bbd15c200e4648e7e

SHA256
3cf9c493c635c2121bbdb6d44a9750397d4775a8494c7583aa8ab93948d06613

SHA512
8daab4e3e091a99693e8fa88b6a4e0a09c633875e4c2524ef49128321995cd65da2e4ea6b49e13bfb37da2e58fc5c56018264c625079979eecdb25c85e67f5a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
f49d8ee35c8753955221a875620383c7

SHA1
1072d5e129867b44328a3ef6c6499c0f85e0fe0d

SHA256
574ce1aa189644907325002bb7f21ec927eb6e963abf08917a04f89c39760523

SHA512
0871a3fe1d51d5b01455decec2fc2439659fad9ab64941a7b203f3f186ccd89d1979e920b8c6b8ffccd6c1f8b29fdb9f4517b65e0eeaa13de7d4c0ee42110887

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
8KB

MD5
035330eed27c51599ba9dcfa16716db5

SHA1
b4d867bef9428781c7e4154e41f5d999b720d6d9

SHA256
345816ff732cd6310904be863d8f9ad7d9864552a4e0a1d8772b35a8ef81089a

SHA512
f4f91604e69aaae46be0f215ea37ff62624109dc80773333400573f6737b9e7b8994b6cdd0c6e76698549d372cce64d1a53b03d827fb306d040a93af4374bca1

Download Submit