hxxps://github[.]com/blpkasher/download/releases/download/vypix/Wave[.]exe

Analysis

max time kernel
208s
max time network
204s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-08-2024 19:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://github.com/blpkasher/download/releases/download/vypix/Wave.exe

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
424	msedge.exe
424	msedge.exe
3496	identity_helper.exe
3496	identity_helper.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe
2252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe
424	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 424 wrote to memory of 2280	424	msedge.exe	84
PID 424 wrote to memory of 2280	424	msedge.exe	84
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 4152	424	msedge.exe	85
PID 424 wrote to memory of 2948	424	msedge.exe	86
PID 424 wrote to memory of 2948	424	msedge.exe	86
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87
PID 424 wrote to memory of 3664	424	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://github.com/blpkasher/download/releases/download/vypix/Wave.exe
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff7d1746f8,0x7fff7d174708,0x7fff7d174718
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5720 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4032 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2252,4073464521084286737,9801409657309616577,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
dec00a510bc9032342ca5a45de5bd376

SHA1
1bebf538fff0ba78acee2f015b4079d0200408a8

SHA256
9b273f1f57c8e896e3e1ffeb788076a45a7acdb92963451f990228cab72f0919

SHA512
ae44684372b8a5c19283e2e5f32a9583352da9f44f2cd9583df77d7327836e71a822b22eb1e6b75c71038af1f626ad811f749de08a4ced327a26946f11b8c485

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
858B

MD5
a51dd2eef520156999bd27409182f4d2

SHA1
800b4153885897a1f6abf5e032c5306ff50428a6

SHA256
91fa54bfa85f506713aa49f37b5fe3ed8ab66ae9e1984826795490d900c48069

SHA512
38eb2388e7cbd2c355e26a6d4c6636c21a71c772b66f5ba8ed68cac3c4e99a55d8640929cea4ce5e9b380308e1b7ace21ef6a648020e6598a45369a4d66c5f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9e3e89403f6dd668cc91dd28f86cd866

SHA1
a028c7cdaa830801095cf1a86476e121fe8ea42f

SHA256
a131d5d9b21cb58dca45abaa461206b3c0c38308e6d39cc188ecb216881a08c7

SHA512
98b8ce6c92a6e0a2d4b322b40f4aaa14d997a04faa78111a7d03ed7640c9ddfe2681d2bd0fd083bdddf6c66763123ddf89c1136f0c3c1ea3d7e4caa942baeec0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d31dc01c4f3280e898f41a99affb04bd

SHA1
bbef2e6f268dde2e984617fffdd8f8ff04ee5bec

SHA256
f010466ad7c40af10d46b8e8ed8013ea90701629eed92330e0566cc41b09a32a

SHA512
85921fe1a73a281cafaa06ab1ef2525fe4f6372ab75d87043954da6abf799b605d8f3bee27e1f081627950b66b672902a6358f79c8dd03092513681628d02728

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4cd37e09cf71887af270451bac154630

SHA1
dbdac3a47a0a4038eb604c33e97278824f689ea2

SHA256
4d8598a1e2cf6ed985aaae36b099ac8d7bc1bbb6393e0488083dab1ee1fd5d64

SHA512
473d6badf10251ecde89d9000d17d8c527555229f792478b26bfb5577b0322d5d619f5e9c269af2635a4cd041d676cd336fb3d0d84775490cbec4b31d6bb14ea

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
706B

MD5
0077a303443a34ac2191a499bb8ec735

SHA1
9424a77ff93a65d1d48d40f246c0aba6f4557cd6

SHA256
bdd4537be69a341f3a714c6a023868c461d66845c3e7d3489bf175011281b17a

SHA512
eb8c01122cb180a148e8e2b7a868783f4b3cc712d2cb75b50819b7b7d5b362e9847263dc0611fecd0dc055feae468dc77b7cb5af99861f3b4495e0ea9152cdb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d292.TMP

Filesize
539B

MD5
a2f46f8207ba0f7c1557abc4d920dc84

SHA1
9024c09a9de1b95af8462e99a47cdf859bf0bcdb

SHA256
0e9544d3ccc6d81e506bedf6f7ed862ce55c522f496b4507403df7838ad82b9b

SHA512
b73d499d0ec5c2c58590fd3c854324661eda2caa5bfe4af3bb43898e53516ead06e1382d00f0af0175336a901602d115a50a458ab9e3bc80bfbca68e27d149d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
146285c96f65b5f22bd7e2ea1cb30b20

SHA1
dc509d3e5e78281872aa6800feb829eea948bfc5

SHA256
16a8735f08c06dee8fad78e3f48ce7953395f104474ef318e890e7ebe34fab7c

SHA512
dd34306f44794fb16879ac3ebd883a34f26c90abe2c062116e69779d7a0b2fde27ddcb502de34e1fad03ddd3ff2f328bf4ffef2eb3f4b2345a77065cb29dec49

Download Submit