hxxps://is[.]gd/h7hu2H

Analysis

max time kernel
148s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
13-01-2025 14:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://is.gd/h7hu2H

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe
1616	msedge.exe
1616	msedge.exe
1236	msedge.exe
1236	msedge.exe
2768	identity_helper.exe
2768	identity_helper.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of SendNotifyMessage 12 IoCs

pid	Process
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe
1616	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1616 wrote to memory of 3648	1616	msedge.exe	77
PID 1616 wrote to memory of 3648	1616	msedge.exe	77
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 2644	1616	msedge.exe	78
PID 1616 wrote to memory of 3544	1616	msedge.exe	79
PID 1616 wrote to memory of 3544	1616	msedge.exe	79
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80
PID 1616 wrote to memory of 1608	1616	msedge.exe	80

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://is.gd/h7hu2H
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=90.0.4430.212 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=90.0.818.66 --initial-client-data=0x100,0x104,0x108,0xdc,0x10c,0x7ff9a8e43cb8,0x7ff9a8e43cc8,0x7ff9a8e43cd8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --gpu-preferences=SAAAAAAAAADgAAAwAAAAAAAAAAAAAAAAAABgAAAAAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=1924 /prefetch:2
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2816 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4064 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\90.0.818.66\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1868,8907215912024798255,2936808547440935318,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --gpu-preferences=SAAAAAAAAADoAAAwAAAAAAAAAAAAAAAAAABgAAAQAAAoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAB4AAAAAAAAAHgAAAAAAAAAKAAAAAQAAAAgAAAAAAAAACgAAAAAAAAAMAAAAAAAAAA4AAAAAAAAABAAAAAAAAAAAAAAAAUAAAAQAAAAAAAAAAAAAAAGAAAAEAAAAAAAAAABAAAABQAAABAAAAAAAAAAAQAAAAYAAAAIAAAAAAAAAAgAAAAAAAAA --mojo-platform-channel-handle=4924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
003b92b33b2eb97e6c1a0929121829b8

SHA1
6f18e96c7a2e07fb5a80acb3c9916748fd48827a

SHA256
8001f251d5932a62bfe17b0ba3686ce255ecf9adb95a06ecb954faa096be3e54

SHA512
18005c6c07475e6dd1ec310fe511353381cf0f15d086cf20dc6ed8825c872944185c767f80306e56fec9380804933aa37a8f12c720398b4b3b42cb216b41cf77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
051a939f60dced99602add88b5b71f58

SHA1
a71acd61be911ff6ff7e5a9e5965597c8c7c0765

SHA256
2cff121889a0a77f49cdc4564bdd1320cf588c9dcd36012dbc3669cf73015d10

SHA512
a9c72ed43b895089a9e036aba6da96213fedd2f05f0a69ae8d1fa07851ac8263e58af86c7103ce4b4f9cfe92f9c9d0a46085c066a54ce825ef53505fdb988d1f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
50bc6cb6639b1498b77ddf45ea02332c

SHA1
8726257a524c8ad448dda257c70a3b49a93fdeb2

SHA256
12df7fa6fad6a41314dc739badb741ce3bcf05c23b92270ec28d2c2188e04dd9

SHA512
3595775960a8808160d31041b6b376196556c99299530d9b932d2d5eae37f7a5f386126658e090a99d0e27ad03d9d63767d2c137d3655c42eac258edb2a44fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
528B

MD5
bbbc4d681d448e72f3816dae151f211a

SHA1
7e500c6d4d950d6af2b84e54de0a78a76df0b69d

SHA256
7f087e97236a3cf33bf3bdf38a4ca393cd19a88836a796bfd524f395a4d36b67

SHA512
ef2679722c39d36406cb26561406c5c33ca1d147ccbb983b2ba78241a9f5a18327f8cd63b5dce4f3743d3f84b9fbb9bd35a0245a84d5e6651b2e3a3cdef466a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
848B

MD5
0326ae8effbb1e20d01a722bb2cfede3

SHA1
3ee1ac0768284c0dba46ede8cb134b72537911d9

SHA256
09cd5ddf26b5c9cb07c2a752a68b945f49a8d62e196330a55b856267be0b3eb0

SHA512
ac9770cb47340aed703562896008ea9165f5171d87cf3e06cf7a7dab45bafb78022ea143fa810ec9c3bd751e9f88899b76b29dea220d4ffcd6a17986a05dee07

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
94410ec3e09296d8f76ba12d7c69bea1

SHA1
8bb95c83fcbd10e63a1d51bf53e8da267fb57a89

SHA256
d1403799606816a783f2d2e7cdd00bf763b38eb2023191b601c900704121ab08

SHA512
7b42174f57bcd1d05bd4502bc49e0bd241d3af5c8249cf6e9242c6a7c77b3a796dcedf0302f7c5d6bf143ed8adcf7fbf111895be53a5c4e4d0a6460d273a3878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1dcfb82caf4d383fcf5c6aa1a57e4cd

SHA1
364934c86f5320d56cdf6e37326cd9e3cdaef202

SHA256
01b194ee77f3ce0ab3285771a5c5a562f34d8133af97f2c25563fb743587ab41

SHA512
8275589c2da19cb0130ae8da4c10e3c3e268ebc6d7d51ca5cdcd75d635cc33811f9e2984e904d36cb542a7871b68a64ee888e415bfc26fd52dc5d86be5744b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
011f79a5b2cd502db81d5576b67ac067

SHA1
157c4c3640fcb1a29af77af26b8d77426c134d70

SHA256
6560fbfe8ff708d83b244ee8822d62673040ab543020c977cddc0b322bfcba73

SHA512
09b47e0c156f2daa620f0d0d93e2f02add0a7f1305f329f5a7d6c34dbc2aa091c97c594037b392f77f47545acd20b35fac6ff9c6790f96b5f88008a96eae0cd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1bc72a367539e7573504d35df4851a70

SHA1
ac3697ce8d17cda92503a3a698ede0a8ec1cf901

SHA256
0100e135f73bb9029626a5f29a0658e18cec0a437ec760584871f87425bf24cd

SHA512
269699d0dea3ea9bc9b36d82c80d12cc78808147b4bd70a884e52a6e441fb0255a3534f17deb0288647aa8b9d66bcae50ae7293eaa3d325e229bbbf0cab75558

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
9262b97427d1dc60416098f7713af3d3

SHA1
508af8015114cd5917728a39d6b2e7fb3f15c885

SHA256
b00a2acb733bad642eaef8d5495f8f228c52384a312ed5c7bb50fc4e2b7a9739

SHA512
45493918dc65b05a2ec6a7d8509f707339ea1bbe935b6c02439df76fb926a73a2229c2c052426617100aa07436a793656f574b43da8894a080378c65b58352ca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe597100.TMP

Filesize
1KB

MD5
f913150ed96abcd3b53ef3da11c72372

SHA1
2a47c282eb08b83c3756f8e398af1f73f6232eac

SHA256
02ba32361b5e9a7f1e328d96952e5140eaa92a65adbec05bf1dc09d760351586

SHA512
86feff67d1ba84da764167165820c59664cb1b3bd1d5ac010b701b32d3f801976552606ebfd10bd7890614a3ee5400e870ad961d42716482f0fad1f2a067d265

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dc3f618a1d0d9c509f605358f6b1e0c2

SHA1
c5285f50eb659d71fed68c5252f029a24535a3d7

SHA256
33126cb154028cf9596d02a0cd6882603503059caa5053369e209425e32cdf71

SHA512
01f5748ee0bd5e9b6be7220effa0a4dbb1232f270dba1cbb7aff7aaf84b9edab6a33ef6393285ba3e7d606626b5cb9c6d0c5c92932dc765a3718d304389dbacd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cac1b181e0b51578acea85c9b5c0519e

SHA1
1a2101666a1ec5427ce9e12154ca463c48a25a1a

SHA256
54102c41ec38d42fcb314123740286b7ab7b72bd8f6a8e54720b9a01debf8a41

SHA512
918b5d0775bc786d816fb9387cf772f6ef66bb1bc1e0e2fd1776fed8381e048595e04da865204ba980a4a4610bcf97ab701ed20a3bf21a8e369c2cd5d14e27e3

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic

Filesize
2B

MD5
f3b25701fe362ec84616a93a45ce9998

SHA1
d62636d8caec13f04e28442a0a6fa1afeb024bbb

SHA256
b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209

SHA512
98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84

Download Submit