ef9310af31b791a05561164d25b8fa1297fd01a82050828da4f53eef7df2711d

Analysis

max time kernel
126s
max time network
124s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
09/08/2024, 14:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

redirect.html
Size

6KB
MD5

f99a30d8529b28d9825b595a454be330
SHA1

eb05af44851bc862eb0328b0a01682f90acf1db4
SHA256

ef9310af31b791a05561164d25b8fa1297fd01a82050828da4f53eef7df2711d
SHA512

6a205ab91906c7bc257922a1f6520524065a0eb6c96572d9b9f6a451345c1930cbfb0262dcfaa200775424babdb6ec072f7b7dc0f83937a9a6f179472d335344
SSDEEP

192:dtHLxX7777/77QF73yrz0Lod4BYCIkyOQXcM:dtr5HYq0+CIkyOQXcM

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
10	api.ipify.org
40	api.ipify.org

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
4268	msedge.exe
4268	msedge.exe
1444	msedge.exe
1444	msedge.exe
2172	identity_helper.exe
2172	identity_helper.exe
4196	msedge.exe
4196	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe
1444	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4916	1444	msedge.exe	81
PID 1444 wrote to memory of 4916	1444	msedge.exe	81
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 1684	1444	msedge.exe	82
PID 1444 wrote to memory of 4268	1444	msedge.exe	83
PID 1444 wrote to memory of 4268	1444	msedge.exe	83
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84
PID 1444 wrote to memory of 2776	1444	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\redirect.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff919813cb8,0x7ff919813cc8,0x7ff919813cd8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1948 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1888 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3172 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4552 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3988 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5676 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4632 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1936,2789005396946283121,8391928827277073386,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=5964 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2808

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8276eab0f8f0c0bb325b5b8c329f64f

SHA1
8ce681e4056936ca8ccd6f487e7cd7cccbae538b

SHA256
847f60e288d327496b72dbe1e7aa1470a99bf27c0a07548b6a386a6188cd72da

SHA512
42f91bf90e92220d0731fa4279cc5773d5e9057a9587f311bee0b3f7f266ddceca367bd0ee7f1438c3606598553a2372316258c05e506315e4e11760c8f13918

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
058032c530b52781582253cb245aa731

SHA1
7ca26280e1bfefe40e53e64345a0d795b5303fab

SHA256
1c3a7192c514ef0d2a8cf9115cfb44137ca98ec6daa4f68595e2be695c7ed67e

SHA512
77fa3cdcd53255e7213bb99980049e11d6a2160f8130c84bd16b35ba9e821a4e51716371526ec799a5b4927234af99e0958283d78c0799777ab4dfda031f874f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
6cc60ba5bea39dfad11f5502587c43fd

SHA1
05dfefa11edfcab343fb0f2571d6894d1e1b55b9

SHA256
b0c5a626bf89885c923fcd8116302d36663a837aa9651db9d59ea777ce37fd63

SHA512
10e34463cd65347cdeff0cbf2898be155bc8dde76e0824daf15ca3bc94994b5d82eb1836edc66ce3f276ece02036b42b524c110a6afa3a89a7a708d77674b238

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
62c23af900d46ea97a38d253bac0a53d

SHA1
77a56b444455f44b76faf85d887710fcc5025e15

SHA256
2da8240c1a84945a86b0cc5029e885ce33dd20cb84c4624e0612fce8ea507372

SHA512
9363bf7f699480d916b9068946496ad7679542786bed6cd283ec0b02c23a5a2503ae34a1b3e2cb73ef0027efec5e1c6c19485adf6ce2e4f66f528b0bf6f43026

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
127306644317cf10757d617a1989c246

SHA1
ea473ae83786491f26df554a6ad5431ae5031658

SHA256
eb42ceb301e24597cdf69708a53ad170e2f139ad2c2bc45f66564c2d960cdf62

SHA512
2cade4db0677bccfe337f0ae425930dffd434bcc23f284dc2d0968edc011d7887d27bdffa994381e1160c252887bf94f791b6a37c2f6dd1d31165bfccec28db9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3f0c15bc261a30a685583e47f4ba0ad2

SHA1
7368e22efcfb649fbc838a1dcd7d60367d91d7ac

SHA256
948bcf29bcad3b5258407d22a8ce83f6d8586fa8c6a5326ed04501332e61cab9

SHA512
403aade272bc067286794527974682e158c4605d0261f793ef8c5ec268dc21a6d9745ac6fbd460eb60b408c0f9ee23c81ffc8f7436a2b80eac4099353d7d434e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5b9bdb80bf954ab2ad1a90f3530fdf43

SHA1
d3393f2ea6466edb5a15c08b1998d838c95a771c

SHA256
5f64512468402ef9f7fdaee0a77b2531098bc1f5daa879e41ca55756eac6519c

SHA512
0b9aac0f1ce3c21dcddcfcf258f4231a267b735f3f628e8aaab815188f36c3cbaa44669d27e495cbf98da3234bd2478479052e56df3b150a9828316954e061b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
5c2888751b0925b4c744b0216de55c41

SHA1
444f31c06faed6bdfc1dee7ef38083ac1e0fe97a

SHA256
111a1ca3f84d2c9f9da0d879058299da9e90140e5f05317b80c2f4b1a5ef17d3

SHA512
342e2dc6e13f1547f75164dfb2c8633398e942a7a3f258b32ce4e3e5beeefd0ae00abd0789a8968ffdc7ae5c0c3fbc33c984baa4047ea1a8f5d2446a3fd36fc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe59647d.TMP

Filesize
371B

MD5
1911343a1b2c39cef24a043db198841f

SHA1
194bc63b39d27ec502517b002934c92ffbbff283

SHA256
1dd79a224d0bbfb7e1de4dafadf7face7e57028e8d5e1cb82e03b0ed4e838fd9

SHA512
5cadd634808e40e543664a81cc5b33eaaf11aed4edd31dc11fb22b0c7445cc0c67595e17b31f48171ba698df9c8f59ac2883d07a690aacc5d51e17fb34efeb0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
64c8a1853b74f3064c0d9987e01a6b47

SHA1
7202e1f74ae2a036a4005d112d32f592f313c4b4

SHA256
2467daf78c32753d799780426c276f7bf43da137b5af13419c3a002aac05bef6

SHA512
c4459eeb1f257e3275addafbb60aac85fecedb04218fd352e29cac06abd46e68f37f039e3c4647ac08131c4e0706067a8f46d7481646ceae43e6ae709c1178be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b15d9f68e07eb0cf4937aef748b93361

SHA1
86aeded11ee2cb5b5889ad68964e9ab9124ea518

SHA256
cee42f7a63060b8f02978e00e5c1cca1d72ec3bbf09ec59ec1ceb9b8ecfc1825

SHA512
0cdf76032f73e48cc03b5bb574b1d44968e6e8129d524eefa02534a3d8c33d7706a3dde91bfff4f9df5616c400e5ad57443a6dc70924564c6599cb978f302c99

Download Submit