hxxps://myshorts[.]site/EJng8a3

Analysis

max time kernel
99s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 02:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://myshorts.site/EJng8a3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe
4992	msedge.exe
4992	msedge.exe
2856	identity_helper.exe
2856	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 3124	4992	msedge.exe	85
PID 4992 wrote to memory of 3124	4992	msedge.exe	85
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 2776	4992	msedge.exe	86
PID 4992 wrote to memory of 4492	4992	msedge.exe	87
PID 4992 wrote to memory of 4492	4992	msedge.exe	87
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88
PID 4992 wrote to memory of 1424	4992	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://myshorts.site/EJng8a3
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba4718
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5908 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2264,8227319747838538888,16121942375891799784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6240 /prefetch:1
  2⤵
  PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
f422da260de558e3f7d8e7bb92629454

SHA1
9c6e7b9e2295c774034ad82db04d27ffb39bdb88

SHA256
4fd58e8b904ae14535aa3bf7520c99e8d786bc29190b69c9041f8e05cc41f549

SHA512
b7a69147d83fe7899b72dd7bb81f0f7ced23c8f237902c199091e8dbb150d66f38d374f6df42bdd695e8189c791b145cfdb543ee73646bb239f3aa1007aa091f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
a4821b575ab9a73d5aca9d7c4129c669

SHA1
c482426b20e8255b1916c0ffd389a4d6974c5b75

SHA256
aea7bd63c47c999b3d4a2e68f83e8e2c071936388cbfaf1535c372519d749289

SHA512
4e90b8b684e2041001456daca29d1c2c6af4dd1b36c74e43c1ede212fdb94eee60cfe24e1709c6436abdf4ecc3971117253295762107fbc14a322772a68142f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
653de4cdd82d971cb07b1ee2a216a9cf

SHA1
2ea8ae0817305914096e9f21679e783b5420fb77

SHA256
a6fac551d39c28ac470ff2cad7ed800c9c4d14099427176ece6a49e40a64c840

SHA512
a7eeb2a5c20202e50ace7d9e0ed6f98445a142078ceec9f45609301ad1875f03523d9e3794d99097cea4fa42f1649d95c79dce63b9f8b4f1a1c00e808b1dc605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2faf6da356d50c6d223672f3d5aea29

SHA1
74b22126d5c9593e559acc465b6406733703d035

SHA256
67f3280b6ef3b6e89ca87e5750068a098d8b5975a9c07850f49406027fecce90

SHA512
61fc9accbe97880ac6824355e10d102b2a57c955b4130c49475513f0600343d30b678a44cb9102ecb6747c5748ee62e9b928083c4b7f26c583ab2f2249a7097a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
53d53897f08551cf0b6003eb4b4473d2

SHA1
90efe715a9151734c499b864c4064199bbf4e919

SHA256
c46e2c45741ab6e3640d0d77e106e58b27b6501e223c8d6c1b400782e84096be

SHA512
9c7b4037bc806dd3928702f21177a783aca8366559fbb71e874ee41e0db229a13debde5e92b36e3a44bf1fec69088545a04b1192c7aed5303fef764102d43d1a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
81b9c308a5efe2c35063981af10d2226

SHA1
747a29df1af2ebece3f10289df153d3244d16751

SHA256
290d92608b9bd727087e61600f0d045789492497937ebbee54c2a6f9d750bc07

SHA512
729d860d42ea8727328403f9103b77d7fbd7947a020dcc7e80403cdcc12b608a3707def7f1488998067f5c988ca7061d8c5c53aa700eccb85414899e61a52fe2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
494a861dfe3fb61b7f6e9a8e1f92d179

SHA1
903db9c91a888cdd2a359e921ea2c1a958228aa9

SHA256
46ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690

SHA512
f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
56d97c6e6b441581f848d28a96ebc42c

SHA1
85d009188caca6562474a3bd722760636bf4e650

SHA256
1a61f095008f17cdd30e1ffe9ca3ae8b5f99573944244e70f2e690b05fe441a3

SHA512
aef95cdab156cafbbe020eb89a9fab3d30380f44049ac0d9bfbe534e6c81372f02042ac81356aef4479ca418f80aa4f8eb2e189620ac5f3dedf08959633c0ccf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58e9fd.TMP

Filesize
204B

MD5
25e266d997dd073814379d8c55787a91

SHA1
106872f9f280f0baeee7d4967575cb2257d3530c

SHA256
592ec40462ad8c957bfbead123e7df157e379dd1632e5d6a1d7971e339dd1194

SHA512
78f2b34bc296dc2b9e46e91a0629c46ebeb87f94c1fb85766fbf78bb50c23a216aaade13856962d4268b3e043b7dcdb558596585cdecb3155f3f8036e915d4d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
76855d76f5bdce2e9eff4a212d2a1c00

SHA1
dd0fd5de8f0c77081f3f3727e21522c78b8de27b

SHA256
9e7ece095af458fd6ab62fc1a323a5ea4ee163f694afb63a270bb2720fd2435f

SHA512
46c0345a1b830155bc14f94a8eb21f8aa1df6cae78b3e4061c63dff709cf61a3b7db8d6da6c30180900d40c35b4e4b8c6581ed464864639fb7037d6200714238

Download Submit