hxxp://mdgaming[.]site

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/09/2024, 17:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

http://mdgaming.site

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe
1028	msedge.exe
1028	msedge.exe
2668	identity_helper.exe
2668	identity_helper.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe
1868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 4836	1028	msedge.exe	82
PID 1028 wrote to memory of 4836	1028	msedge.exe	82
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3912	1028	msedge.exe	83
PID 1028 wrote to memory of 3588	1028	msedge.exe	84
PID 1028 wrote to memory of 3588	1028	msedge.exe	84
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85
PID 1028 wrote to memory of 3800	1028	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://mdgaming.site
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd183e46f8,0x7ffd183e4708,0x7ffd183e4718
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1824 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,4190389782650535563,15037663449242467065,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
39e75ca88bd0b4a495a0434d56a0ca7a

SHA1
d8a71379750164568205185d1b3ed4772f67bd15

SHA256
0ce8341d61a3c9fe40d745501cdbaaba40457b76c1c3166e5af43fa740307fa7

SHA512
b4fc8b34fd59c029389007725000fe025f8d9c11fa7b9db38b1113fdfefbe0767bbc70c2f3117c9104a1176896f3696c3abab718c437927204918649fd821dc4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
13376b15075146c0144cf7b9ddc3b23b

SHA1
1868d7dbfc1547fd1c74ad858d2df56196512c87

SHA256
d8d8e95ba171970360bf743526bdf7fc766d11512790a8eb1774dcff008c89e9

SHA512
60d54fdd0ad287bc772720eb6a56806a220598c92e7305c9db107df94ceed9bb0e517ac3936c75bad367ed829f144d5c8e7db16fdd2e803eeb3a72b8c7ad06f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
843B

MD5
1a912d78280ec03f4a96a844cb44051e

SHA1
f6fc5f38066d65e85626c926859185ea60550ef1

SHA256
6288b6e4599b8abc058baf39e1e0848d9a8df628a54d141807036604b5cbbd8d

SHA512
e505566d0b40422e0c18f25f3b8c4df72cc157ac3bb42d1de98e505af40e48d42d34342bdfa95a7e7c63d8a25e2500844b5a82f0c0a1b1edfcc904b222152782

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
843B

MD5
f9d48e53d48d1408a8c0c13f2f14269d

SHA1
5f3ffd7c7c8aa575e2a3e6cd9908f4d8d0bdd391

SHA256
c0752db4b815f51567ea5e646d71839c706678b93f7249afedb67767239d6527

SHA512
fec47b43b1519d650b3f8874c7c0676f70c392edef6951b227ec54b31a2b72019a046f8ec285deddfc437f668402f62149e8d8e0d1c2fa08df70bde483e86575

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
534f1cc000e5808ad39733a0c6a9b524

SHA1
34f3afd067cb15e8260d08eff4f135cdb5f8690c

SHA256
1f85e42c50122d71add53212b8357d9764aa07324a09a30db8536c7b40d27966

SHA512
b9f59426a05018d4f4573bb80b23086cd1d27a938f846c5d178783f5fef6bbbbeb0e956c0452fe2848861b53de25ab47800d33663510901578a478c6e651d88f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f235a9e7da448e1541d07f9cb3d473aa

SHA1
a9cf685f9d8fab51cd2ec23a7d920a82318a60a7

SHA256
2b5473caa9c174b9236fd9c8d4f3044baa541af7112f591b47d6299ef6161cf8

SHA512
dfe1c8622fbe1d51d024cd0061015a8870644ef3c495e21d5e1d9bcfd1f2f01a9f9ac13ee5182cc738989fa6b2f9b7935c7db94cad313adcb3181dfa2bba45bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
88eefd7d17bf213a8b6045f7786d93e2

SHA1
f08597db3ecc18326fce798d5125db26459304fd

SHA256
2e3b9e65a2392aa7d6a736fc489120957d3f5048db105fe33562689c9ec0c185

SHA512
6422dd12892029d65ceeb207f39e5ba43e945d0ce20a7bde83f9d048e017534478d111d6df29f61d5eb0a82cd46eec853be21000d215ef63657b9b9e07c2f189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
147f6c002482f3ec657e92865a43ff9a

SHA1
bac1f5541b5aa8b36f84116d36a0b46d363313c8

SHA256
c7652b8f55afd3be46a291d3d5ab3007f2b5ffd654a9aaaf82072d30281531df

SHA512
619f565506aac72aacec8408f2021a141cb8f0d4b3552f04b75d6fa02dce94fe76d08f06f57cda001ead0306bbdb3b69aa09b71021044c09772e7eef71f2f9e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe598eb9.TMP

Filesize
202B

MD5
f378fe7f9a1839102951cbce4fa7a9f0

SHA1
521643e180d41a44131a919a80a21507b498005c

SHA256
191ee6115a7c82ed9259720e6b2cdb48bf18df8f417a158651432cbb7bddc84c

SHA512
fef68ea16a239a9ba0731f5dc05dd811b3d9d2ec75d18e94c2f9c0e4a9d2394ae78b7d49ec514b1af2360f05bb1ca4f228e40d82c59c781a66832d9bf2f8a9a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
fafd5344d897b3acff9a186cf3b36a03

SHA1
23f6c2946ae1612786a0fde0f35c17ce6af7fbf0

SHA256
b1329b38e5274c1c6365cf20164903b578d6ddb245316f81b814a4a98c6ee18f

SHA512
ed2db9bb05d124e26efdf471f7a844fcae226ff421c66bf00d38efb8fd94db6239b07bc146e2b5737adbfec4081cbb9fe0c6d8dad9f4231a6d9b5e20b57c91e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit