hxxps://www[.]baidu[.]com/link?url=x-W0fnENhKZO_lj-hUYBfyQwZkeeNiyMCDyzuF0b2ZeyijSsuD5qJ512ggrcpgSA&wd=&eqid=

Analysis

max time kernel
146s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20230703-en
resource tags

arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system
submitted
17/08/2023, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

https://www.baidu.com/link?url=x-W0fnENhKZO_lj-hUYBfyQwZkeeNiyMCDyzuF0b2ZeyijSsuD5qJ512ggrcpgSA&wd=&eqid=

Score

5^/10

microsoft phishing

Malware Config

Signatures

Detected potential entity reuse from brand microsoft.
phishing microsoft

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe
208	msedge.exe
208	msedge.exe
4632	identity_helper.exe
4632	identity_helper.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe
540	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe
208	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 208 wrote to memory of 4164	208	msedge.exe	79
PID 208 wrote to memory of 4164	208	msedge.exe	79
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 1264	208	msedge.exe	83
PID 208 wrote to memory of 2388	208	msedge.exe	84
PID 208 wrote to memory of 2388	208	msedge.exe	84
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86
PID 208 wrote to memory of 4180	208	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument https://www.baidu.com/link?url=x-W0fnENhKZO_lj-hUYBfyQwZkeeNiyMCDyzuF0b2ZeyijSsuD5qJ512ggrcpgSA&wd=&eqid=
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffafe3846f8,0x7ffafe384708,0x7ffafe384718
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2200 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4424 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5664 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4604 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,9379683748114454189,11280736268575179830,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=212 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4124

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b5f5369274e3bfbc449588bbb57bd383

SHA1
58bb46d57bd70c1c0bcbad619353cbe185f34c3b

SHA256
4190bd2ec2c0c65a2b8b97782cd3ae1d6cead80242f3595f06ebc6648c3e3464

SHA512
04a3816af6c5a335cde99d97019a3f68ade65eba70e4667c4d7dd78f78910481549f1dad23a46ccf9efa2e25c6e7a7c78c592b6ace951e1aab106ba06a10fcd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
f9e2fc4aa45d8c19c1985a3f08b2a1cf

SHA1
3351be3d1d312dbdc9a533eadee89a388f6373cb

SHA256
c7fdddde2d32c38f4a8d0356765866b7758d0e292a86e998c870c482b1420944

SHA512
9def454bfa64a1e3e20cedab03c8f61695e8fb1f0ba6027d00c64a0030fea16fe6c4af762fd663969786fb0df23e3b4babb523d94cb5336ef07dc5bd9e4bf186

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
739B

MD5
785ae3a627e2baf3bbac943c2c4076b2

SHA1
5ee9603347210337189f7aa190173ec45c58f6fe

SHA256
145ec9f1536e9f97aba0fbd9d53e3ae1b2ea8f198e628fecb94aa1e3be9526df

SHA512
b793c5732c64af2d9ca71edfe8e4270a199a37195767003684af6cc801798551cce23ca0e8d0234d68e9faa7d479d56c89a6dd9ad3ff362bb377ab2ede6427cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b24c0f8247618b5ac01bf2832305a297

SHA1
c5b0d13cbd448f30fa015700b8a46df392929425

SHA256
898e1e7b80b7cd91aa062cc781d55d5ad735e56c40b06f71dbf83a50d9b95a17

SHA512
f39f2628131b87c21e9e69eff7f64195fca2c5b19a8aec12f5c52c6686a76541e010984192d8e6d656aef07179a74fa0cf0207724ec44a8b487c114f0ad60200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e390f9d98f5b69ed2df2ec8db7d1f6ef

SHA1
be02ebce3bc6a8b31bd6e44c15da315e04b9461e

SHA256
ab0360abdc16c4b592f95f3f50beff2bac666a694ac325605e090f598cedc32d

SHA512
9e7a2806fd33dde4ce95a9000391f6ecccf9196b4ecad2cd58a40d7283dfa0fd51e9b57ca1bd56ddf44149c83352930d8d24bbfd46940999cf9a0fc413dad92e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
29213338df67d29d6454ee5d61ad3970

SHA1
8c69ca76a2e639060d5ce835a9600e6ea3764a83

SHA256
d29fc0d97fa74d382d0f557ecea4e42b7d50dbce43915bfc0c114c16e532aa51

SHA512
14db25eba8a863d390b97fce4315402ed7c249598ff6c31d5a191b0f71c274eead42ba0658403e744110de072e6ff1cac3bccee1e48875bde6b1fe39a60d2407

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a1eb22bc-a558-4463-b785-bcd36607b9f6.tmp

Filesize
6KB

MD5
de37b4238893045a02129e68f141ec77

SHA1
fe540fd223c5f80b48b7349681d2ffb499784ef7

SHA256
86fec41820827af9a17478d03a95d677de39222bbae1bacc600403c02deac59b

SHA512
9b08bda789e91da59f2f9343e4f69fff49a0d10f1dae951969e8285533ed692c4c72f91f63685b0e39af4aad8905b697ecb7f5427c41924ed45bb59a1bd5016b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
618d5a123f65adfef3a856bdcefc7a14

SHA1
0a4eeab1f6d105a28aca9bfcefa052fca37b6682

SHA256
4e3b621fbfffc2ef78e87ff0de0aff929eadc5013620dcbd63dbd77661c28016

SHA512
141b03f116fd7fbb07fbb807a8fa93af9f068dcffe5038bdeaad9c9f1ad22e61c7a32598dbf9458fc248a0f97d2d4d165490012951c3cdcbd0a49b39bef5b90d

Download Submit