hxxps://patriots[.]win/p/17teNlLcZu/the-ccps-winnie-the-pooh-just-ha/c

Analysis

max time kernel
93s
max time network
93s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 06:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://patriots.win/p/17teNlLcZu/the-ccps-winnie-the-pooh-just-ha/c

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4284	msedge.exe
4284	msedge.exe
5000	msedge.exe
5000	msedge.exe
4288	identity_helper.exe
4288	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 5084	5000	msedge.exe	82
PID 5000 wrote to memory of 5084	5000	msedge.exe	82
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 3740	5000	msedge.exe	83
PID 5000 wrote to memory of 4284	5000	msedge.exe	84
PID 5000 wrote to memory of 4284	5000	msedge.exe	84
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85
PID 5000 wrote to memory of 3680	5000	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://patriots.win/p/17teNlLcZu/the-ccps-winnie-the-pooh-just-ha/c
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe908946f8,0x7ffe90894708,0x7ffe90894718
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5172 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,7260108459160340263,1751936310488654136,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:1248

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
2c9d34d61a8332f37691f848ddd5c22f

SHA1
78133d638e4e2165d509d5d00d68a2e6b22348ed

SHA256
7ed5ed7e94ff2ec4d49b5df1b343c9f8c0c2cb0dd9e51e28eb2116e70793c608

SHA512
a7eea1d1411977da004dfb3c715ef3d83dd37abeafd46493ea0151ae17b705e3910f6abd1837e538c18916cd3431e30cbcabd03890fc5b319d7292cb04c2da01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
42382fbd7ad5b324527c31c1b4939b97

SHA1
5eceef06e4b5361ad9baa713b73b4c7413ba46c3

SHA256
5c1bb40e4dfb3f3cfab75c4e73921a42bacd2a72d74a1da9f23c2ba3bceaf284

SHA512
57a67b6928e4617549da9259d544f451557de796e2038046b33b037310afa8bfed8bd4cf714acff40fe8861c4a69730930e80090b7a8d7ba3bbf9345e05d150f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9eda1840500fd2d59cc8e772bcb5a4c5

SHA1
106cb4a2d08e99a0c7109993ae53c48786c3b189

SHA256
4d4340cf82a840142e35ccd60b5d5fc149e82f1ea912f580acebd2a74bc7d312

SHA512
89319ad6b7eec14e7b968c0d3ba3ff5f0cdee9335490408dae0af5bd9ec4aa2761d32c949f31d216255369dcc6742930dcab36405736aac31114e36fc6b4a5e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b16bbda1b033740bfd8b87108c5dd57e

SHA1
2a5c69baa544e79700d4aa7ee4297c400e055988

SHA256
8cbcc966119acdff96b7e08e326f31bb14d0a5bf70b82313101c96991eb02a15

SHA512
f02eeb172b920a9ec6b437d2040f4dd043e0e8555308a30a2f6dd277785f073b53f35567f5f2819fdf87da535a1cf2d5244c0a8fdb1e1289c53055697ba0ccd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
97f7dfce6af91f17052f76e4751d7df9

SHA1
857ed7c7831c6670dafdfaddf4969f980bd7cbed

SHA256
71fe6b33127c82d9ac8bdd97dc3173b1464d6b1beb9a79b720b5f4e07f253f87

SHA512
68f0a2a64d08c9157ee415b8d7c0bfb3341934b44030b6504127c25a6773e7211e89977c64213d06c3fd86161b5514c3db91bedb952bd692b62623b84ddb2bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90d4810d3e136cec9cb2ce29c34ecd53

SHA1
4643299ef99290f1e5e81a627f8d3b538f767552

SHA256
c4ef2faa4ce97822cfaf7463588f1319aba4f90d92130a75e467a825f0337e98

SHA512
8c6322ef0fe0b1852f3334241a70155047d1564d9399424e97c8ec5bc1f0051fb96b61ce5644bcd7735a890f853cadbffc32ac5536696e8228bdd3187230af14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
35d9f66353c956267d16a9a85733f136

SHA1
66825c2b3a95c71988062fbd6c14fac8b6504eb6

SHA256
b1eb8bedd65eb41418fa9bcdf3338513a3cbc0092e8582c6ee82782ee3097052

SHA512
ae62f0f177aaaf4914d25c3cda3d04df8013337c7e0281381c8485dfe652ae02327344faac7f0a2bdc9dccb0bcdacdb5de5d9313540304ac4d27522dd4fd801f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58d83a.TMP

Filesize
1KB

MD5
f1cd96715b75ab3f4852c34429e11696

SHA1
01490bee1066b7b8a4ce2bf7286228cdc044faa6

SHA256
895cc9c58d03d656d6f04a7b918c34bcca2985b728c0a6eb4db0516b5cf72b15

SHA512
90c7cde0ea3d168c2d4493fe0b811169e369c265ef46c3fe155d5eb635d8c34bf66287fc95dff4647caeab11244e5eb4605bedf739322bb8f08bcdcda154d680

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c8819a61-e8a3-4d90-b5e1-c8c7c07b7cd9.tmp

Filesize
7KB

MD5
c328177ea9ae37d0903dd3402d0c44b0

SHA1
4085d9a0d5ae39d63c4b14168224f478db36399d

SHA256
3d2660960eea5c04d7f24bd830ca80a1254dd46f21d03bde58441a75944f9d60

SHA512
c7338defc2733ef74f1b3db2e8860c2fda0999ca2fe8cc4833e45559b29f7c7eae7d7f998deef278639f538156eec3c960bbcc8fdc6f002bcca80904945142e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5dac2fc6b8a4f8899d574cbf148d3350

SHA1
3ab8917605eaaa55fbe018abc97a99275a5cb952

SHA256
79e6b9221510e5730d723197e491e8b34dba8229304544101fa6ecf69d69f583

SHA512
581ef95a62de466a932699091ca7f4d84a88af7a792a21b4db278c2dca93fb7eec0814e0c7bc0af71e0a6ac2a74086019697aebd9f848bbc3a751c48211ae842

Download Submit