4f91b18ed4a4c54fe57b7e165997d3babcdf223b2b244f4b9f74f1883184c18a

Analysis

max time kernel
1772s
max time network
1688s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 16:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1aJPq5tu6gE6wzH5uVgWHAsSCAgwovdtG.html
Size

280KB
MD5

ff04217dfde0f3d8b35e15b054e503c3
SHA1

247ca3015ea57a1b7f44d6d8c31a37c2860b2e5d
SHA256

4f91b18ed4a4c54fe57b7e165997d3babcdf223b2b244f4b9f74f1883184c18a
SHA512

9e470e9effcd8d287a9e31a65d4ba38ed259fb09914e27bdd961d55cd675de4295e88c0502b131e2e28bd78011d923e6183e798e2d8143265e911cf15bb12502
SSDEEP

3072:Hmi45rBOrxXOCKQwBJoiyMaNHn9X+qjv/JdzOf/iaWCsio5mtlve7+7eTT:Gd5rIrJOzBqr9bklaT

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3824	msedge.exe
3824	msedge.exe
640	msedge.exe
640	msedge.exe
1532	identity_helper.exe
1532	identity_helper.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe
8	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 640 wrote to memory of 1372	640	msedge.exe	84
PID 640 wrote to memory of 1372	640	msedge.exe	84
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 2172	640	msedge.exe	85
PID 640 wrote to memory of 3824	640	msedge.exe	86
PID 640 wrote to memory of 3824	640	msedge.exe	86
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87
PID 640 wrote to memory of 1188	640	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1aJPq5tu6gE6wzH5uVgWHAsSCAgwovdtG.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe109046f8,0x7ffe10904708,0x7ffe10904718
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2496 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:1188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,2976845945003162328,850903577566096847,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:8

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4816

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
85ba073d7015b6ce7da19235a275f6da

SHA1
a23c8c2125e45a0788bac14423ae1f3eab92cf00

SHA256
5ad04b8c19bf43b550ad725202f79086168ecccabe791100fba203d9aa27e617

SHA512
eb4fd72d7030ea1a25af2b59769b671a5760735fb95d18145f036a8d9e6f42c903b34a7e606046c740c644fab0bb9f5b7335c1869b098f121579e71f10f5a9c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7de1bbdc1f9cf1a58ae1de4951ce8cb9

SHA1
010da169e15457c25bd80ef02d76a940c1210301

SHA256
6e390bbc0d03a652516705775e8e9a7b7936312a8a5bea407f9d7d9fa99d957e

SHA512
e4a33f2128883e71ab41e803e8b55d0ac17cbc51be3bde42bed157df24f10f34ad264f74ef3254dbe30d253aca03158fde21518c2b78aaa05dae8308b1c5f30c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3708fef4ef2288d88cdf7dfcf793170c

SHA1
84522278bb0bae25e7f610c17c05d963b490ebe0

SHA256
55f7a00b67b111eccee73cedf3dffb3b12448cbef64e39eec7fbb3082788276b

SHA512
faf903e07c5ff7e81ed7eae748e1d61189a62796556856638b85a609130aba4d3c37600bebdbee46d3d2d04ff2208868fa14b9e9129d574d74bba1e15f329912

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
de1e0a0a6c83f567790069e8a1e1a43e

SHA1
95866845c91d6c434bf923c9f9fa9689430184f3

SHA256
540ed88de537ef77310808d8dff81d32bf1bd7ad49a32d925542457b55d28710

SHA512
07c55a873fc593913a0e32c9d21fcc708c2072757d146455794a0748354894f69f32a97b23e43500d8708b8d12c4c58fac82ed84d239ef580cee11ce0c23f380

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
13fa7bfe733ad814c2b128a7c206c1cb

SHA1
993a7d9e342d230fd962e7fab5aa4b745eca272c

SHA256
aea83fffe7f85435b42440f8324bd887ecc894461f3fc749deb38d03833b9b38

SHA512
4b977ac1f3b2ad6b2889d4711ca76a4f8eb7fe40c3366da27613a88b56f9b8818a736607dfb2b949d33653983ce8d894c314f0df87a046fbe8a087138522e130

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
43c9bc000c35cfa8e78224815d0b40b5

SHA1
fb72c45579db6f6c9b0ec2e6b389a8d8e4e4f676

SHA256
4a029d54eec892cad1e0df87ebc658fce8be397c74438141925ca06f8fde05e4

SHA512
710bc4be93caea5713b8805ffea58cffb27bc860261443a2557106d0644b83a4bf8b63bf6dd861af5eb84ee3df7a3291aba63711c5ea66d7eb9aef3769d96cfd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dd7cadb5c7914c6e6caa9d88f7c77d56

SHA1
11c95f89785d4453a51a440f561ad2c4f156c4d3

SHA256
16da7ca40108b76bfc1b9c3c71f69d41c28eb44f05d581bbee505c9fbc45ffc8

SHA512
e494b0e52331bb509683efd852becb13a553e557d4eb218ef335ad9257c5d3dc2858ee961616c0018c8215ef50ebfcaf7d5a7f7584eefaaa6e9962fc99cf0d68

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3b9e204b9ff7be8214dee9253e45eccd

SHA1
c8782bdbbe4c0e6006ca67e64667859376ff3ac3

SHA256
705be6273b884dff748bf32bfd91943a73df928bfa939134507f841cd7592892

SHA512
3d78feac8493ee852b899b7d59774471242bcbb1016e8ac1d22ed8557cbe66ae710adc0559d16761bc2862fe8c9aed60f64e8b5d72909f4f0172150cea93f836

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1cf358cd78e5fce853dffab752106beb

SHA1
753cc8b9a2b318042efe64001ce993f24052346f

SHA256
94add94ca02928032f9d9e7137aae774001657711a762aa5f0f731f57843dad5

SHA512
3359bcf8c54f2c72213e8fb8eeebc44c2a66d6112d448250e6022934486136d4ba17152249d78a595e00b889aa42479c3498aaa983dabc83bcdc32f608d02e63

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5f61ce75c090505d7bf0a1d24eac8472

SHA1
36f3e9e66d5f161846cb6f181fda7645ee9dba3c

SHA256
21aa640cdef090b0cb1d9e47030f6fe26109e45a52db957c26350872b5e815b0

SHA512
61b7467d5549d5993a8eafd37623699c4563c283ee247bac884edaeb201ea61e98c9a328f0d32118136a27500a5cb5fba61c8c307363df3a80d1110a021af8a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
82172e07c44ae1012deb01451dfdc898

SHA1
f77a6d781cdcb51d0e469f167fcac4f1f0b843aa

SHA256
27733f4e4dd8a51d7b27b36d975ca6072202dc73ab9230dad4e16215121b7c11

SHA512
c8b5becf68fd58fc02289ce6c5d2fbb43e34810503cfaba581d245e830ade521a1002e38aef331d9d2cc9a9f17236715686c198d20661f86f4de9c97395caf4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3b2c7806f26119a956022f925769686

SHA1
23c44a781be5c5b1f9563d8bc44afb6868556e78

SHA256
7e7cbc082cfcf1058897dc086dc69591b474a39afd1d034ddeded04f03a79a6a

SHA512
44b9e93f533d30558a245d65da6443183c919208117c4b4de88164b0b0f6b8b3609efbebef14fb61b43e944e858948f5873057b1c2a424f2e6e326228760cb0b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e85b39a316e847f5bec3139f9c411f43

SHA1
650e78b83be37f9cc2435d2ef2b4cf701a6fbb4f

SHA256
b48154cda36b201a1094f783195501e1c3bb397909bdcac678f5572ead340eea

SHA512
a9b613940c0a83569c92cabb7236a9ae39d100749bc6ba04b7e4fb2383cdb7ad19bf4a00c4eece3bbcbe95ebe45c56d9fef9f9725502399c16fe87152ad54b7e

Download Submit