hxxp://greenloan[.]online

Resubmissions

25/06/2024, 07:08

240625-hyqaeawbrb 1

25/06/2024, 06:50

240625-hl3d7sydlq 1

Analysis

max time kernel
145s
max time network
129s
platform
windows10-2004_x64
resource
win10v2004-20240611-de
resource tags

arch:x64arch:x86image:win10v2004-20240611-delocale:de-deos:windows10-2004-x64systemwindows
submitted
25/06/2024, 07:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://greenloan.online

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2124	msedge.exe
2124	msedge.exe
2772	msedge.exe
2772	msedge.exe
3348	identity_helper.exe
3348	identity_helper.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe
1152	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe
2772	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2772 wrote to memory of 3480	2772	msedge.exe	84
PID 2772 wrote to memory of 3480	2772	msedge.exe	84
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 4068	2772	msedge.exe	85
PID 2772 wrote to memory of 2124	2772	msedge.exe	86
PID 2772 wrote to memory of 2124	2772	msedge.exe	86
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87
PID 2772 wrote to memory of 2732	2772	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://greenloan.online
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffde38446f8,0x7ffde3844708,0x7ffde3844718
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2072 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --lang=de --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2260,12298378238516067622,8058665150140628384,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3348

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
257c0005d0c4d0bb282cb470925e4376

SHA1
f9b8efb511ed64292568977c9f2ec255509e8f7d

SHA256
8185c36aaacfc71e42f94fad8e198fe7fb2d868398ceabb89261cae94341cb22

SHA512
2f3e8f352ed3ef88e8c28650390f93f98c92174d268330b886f3ebd1ba0163999051298ee12a054606b4986005452a241c6864cd292e69492d79c37d500556f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4819fbc4513c82d92618f50a379ee232

SHA1
ab618827ff269655283bf771fc957c8798ab51ee

SHA256
05e479e8ec96b7505e01e5ec757ccfe35cb73cd46b27ff4746dce90d43d9237c

SHA512
bc24fb972d04b55505101300e268f91b11e5833f1a18e925b5ded7e758b5e3e08bee1aa8f3a0b65514d6df981d0cbfa8798344db7f2a3675307df8de12ae475b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
254B

MD5
8d28440d17d284f6c7bdd3870f615f12

SHA1
36a446cdda672755cdb7309372809b2f51bbfd1e

SHA256
0248a9f4274be21b78caaae93dd8b4859c6bf41099bf9816524b652cde8fbaf4

SHA512
6f6ebf1ea5997bb798a207f60b47d489a3969a80817cd9f597ec66d1eaaa0ebc62ce3b1f5e8427f466eee78f5b939f57572f1230339ffb9e11975b67b95bab1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
65489961900a06d1195eb85bdd9c380b

SHA1
12d5377e16f1da2705e2792e9be075e94e7ed48b

SHA256
5ac7b18a5d93e50dfb828ce91ef2ebf6dbbdf2a7ae55d2555a4df10620096fc3

SHA512
2d8c59cdb750d2552b44bfe9e10e8808f3d4f541aedd35705af569085426a3216e6fc7f9bf2029f8fea7b03cd7ad14afef4ef738e660d2a486559051d8563a53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e494b5ed840e3034fa09621bbd2014de

SHA1
0df91c56836760c5fe016222831d75943f5063ea

SHA256
d4e6dabdf1c7d65501c7870e960cb21ea23c25379a8e4ade86f5f4d476693cdf

SHA512
8214a43775db094d7a3cf884955cd555992b6a9fde93960e475ac2bd491ec4ffe7e0ce59fba44df895c46d6bb3a2d641a2b18ad056df7d36eedd645c3d0f754a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2dfba3c64660db085fcaa32a61a1f0ca

SHA1
fb558f2a32984ed0166d9e144896a6a6528f53a2

SHA256
23a99bd46a5558813f7e2b32e4784934100be417d2f2f1ff207e05453ba8fad4

SHA512
b2634836f6879196bacd20f81b0614a6c4c22147c0ef8cdfe060bfecc3d7e61a5e3c3c9d8e3132edb332616ffc9f8feb8bf4dd6297553ca6a454d92d3c2da468

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
95cd1581c30a5c26f698a8210bcab430

SHA1
5e8e551a47dd682ec51a7d6808fe8e0f2af39e86

SHA256
d58162c5ae5e18fc06604c285e024c01686093d70994dc93b4ae9d85b4c3f7b9

SHA512
e49403df10177053634c431203a91d26df5dfb23cbbb88847459ecdf4b6107040d0944a3e84ee6bb26cb4e8017a35c8c31b658387cd1b6938ba4cb9f59606ece

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
867ea6800ff7d9294f0b2cf1f4704eb7

SHA1
6d643af496f032707490e6fce44d731be69e0fa7

SHA256
4a3607bc15a64a82ab6a2db6ed3ffad3b1d0f740768c3d6e73dc1b7a2c4c91ad

SHA512
088933a58065fb3e9c4896cd021d73cc795e4927e4230b122f6cacd9074f541eed1b655b04dda429a7019b479ae6cb4c9b29a2c7c04e5efbc5db0b2f58380007

Download Submit