hxxps://account[.]live[.]com/dp?ft=-Dsr79eO5eGhMu0BOT!CMvAis6aqpv0H29kj8DfM6ZkTAFr*!lKzjATk4hj1!EUTkpCInkeaXnWhcGiundrkotWis1RS6I5PPmlYaLDw2pk83hQHG4nRijvPoRzzlUjJYQLq97C09M8nnx8p5Kln!uzmO7OIHd5LtCo!9Krc5C3QfiqWsfHplB2gOmMWZUxy!DTVreVL6kvMWbWY!EUJ2CPZpa8n9uMBlNVWBvCU0UQB08KHYqU1bTONb5jIbL1lI4Q%24%24

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
24-01-2025 13:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://account.live.com/dp?ft=-Dsr79eO5eGhMu0BOT!CMvAis6aqpv0H29kj8DfM6ZkTAFr*!lKzjATk4hj1!EUTkpCInkeaXnWhcGiundrkotWis1RS6I5PPmlYaLDw2pk83hQHG4nRijvPoRzzlUjJYQLq97C09M8nnx8p5Kln!uzmO7OIHd5LtCo!9Krc5C3QfiqWsfHplB2gOmMWZUxy!DTVreVL6kvMWbWY!EUJ2CPZpa8n9uMBlNVWBvCU0UQB08KHYqU1bTONb5jIbL1lI4Q%24%24

Score

5^/10

microsoft discovery phishing

Malware Config

Signatures

Detected potential entity reuse from brand MICROSOFT. 4 IoCs

phishing microsoft

flow	pid	Process
9	2460	msedge.exe
9	2460	msedge.exe
27	2460	msedge.exe
27	2460	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
4176	msedge.exe
4176	msedge.exe
860	identity_helper.exe
860	identity_helper.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 4728	4176	msedge.exe	83
PID 4176 wrote to memory of 4728	4176	msedge.exe	83
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 4472	4176	msedge.exe	84
PID 4176 wrote to memory of 2460	4176	msedge.exe	85
PID 4176 wrote to memory of 2460	4176	msedge.exe	85
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86
PID 4176 wrote to memory of 932	4176	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://account.live.com/dp?ft=-Dsr79eO5eGhMu0BOT!CMvAis6aqpv0H29kj8DfM6ZkTAFr*!lKzjATk4hj1!EUTkpCInkeaXnWhcGiundrkotWis1RS6I5PPmlYaLDw2pk83hQHG4nRijvPoRzzlUjJYQLq97C09M8nnx8p5Kln!uzmO7OIHd5LtCo!9Krc5C3QfiqWsfHplB2gOmMWZUxy!DTVreVL6kvMWbWY!EUJ2CPZpa8n9uMBlNVWBvCU0UQB08KHYqU1bTONb5jIbL1lI4Q%24%24
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8983846f8,0x7ff898384708,0x7ff898384718
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Detected potential entity reuse from brand MICROSOFT.
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5572 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,11312104278344773610,11025032958730494036,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3712 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
93566cfe5fb6827dfa160be7eb49eff8

SHA1
639313e2596dee8f3e56984a963aaddf5d418855

SHA256
0de3f4496ce4c7e868a57d16608db2cc42ba76738765fa7121350e3dc65d19e6

SHA512
6e129905780028167b23848385b8d1439a5012fd967f84487c44968d506a059106f026da31f92855bd3b85673546a1987ae39782ad2ae9bce7effd3b517aa90a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
353B

MD5
6573f0be38be60b011c4e1a7d988ad63

SHA1
b38ac7e23e067e4d320f9d399c912062d9341903

SHA256
200a719886d6fb10b043bb7e4c2e9084b3eadfe8a141d8ecc7e7eb52e69dff93

SHA512
2ba8f26e6baf874b35b994a159decbfa351ab2fcaff7bfe964acea573973d7b6ea63d303619fa9fb936be6952e2e19f6e9752107c981f466aca0ed7bacf9897d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
262B

MD5
8240f18aeedc36abf2b7f20c37c2ecd2

SHA1
3f78d0969e6ccd23012a3b0bf0eb989b5cfffff4

SHA256
e10129bd2cc7527209b7fcac7f52810c551fed77e787dfd3a86577b1e62eeda4

SHA512
5d1f2499400157b45356215f9e4afa6f69e87a2cf61a54ff9a25e8956b0efac3e745e84aba54476a68d804d4d3be179c5a74b4308244520885d3b05ac9ad56b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7b0a33e72fc266174c3facd1b25cbc27

SHA1
1db5acb1649223ec254c1bf90a471754591dccbe

SHA256
2e2bfc325127c4b8ad4c021dbf4a372951602e54a6cbb2313ee1922d1cba7bc0

SHA512
607c96b8ea0f82170a35c7e05e06640f34c49902ecb67339b1ca7a68e3b6ab55d8becb32c397dcb4a646eeff245d5979c9f40ddf6921543083c928438341aee0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
718e8e5fa9deaf94c9863b1acd1b6430

SHA1
426e7137a6c2ec312f09dc35dd5037faa6d014d6

SHA256
4705af6b4c9c418f6c50fefb084f2fa6f6e9e28394d55809441e672338028cac

SHA512
7359e276bfd037027eb90c5d09203801b26188156ecdea3df7125bfacff6ebd0a4ec508cf397f0615a4e80dc31cbf3b85a3d200a17c6c2573a5ec5cf2fb44a19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
143af32d42181b9d169176790a50a139

SHA1
64f3f1a085fd9f1743d11267fb5539940f231a49

SHA256
0ec2fa5b8feebb47c8a3d17f250b097e3294b520e6776c3af9fe294cc535a1ad

SHA512
45aba6c8604c565816aa71cfaebffd516da822b7ccca7c0eccae3e43e4ccb9d4dfb42f1b827ae0dc61626b055fbbc4d4a2c467649809a73048f7610f0e4f0b9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58bf73.TMP

Filesize
203B

MD5
05f8b3404d03607f0cbb2c9acbdc7c44

SHA1
34830bb42b6fa46426540b0680371ca2b17c259a

SHA256
aebcbcf13fdbe1960518f877535f03feb5d49ca371c0a9a9054d332cf20b7b0f

SHA512
3f8e1f68e811edc1284b6240b95d43db20df71f8981f74603aedf61881fb33bd0ee721191efc5ad8ac1e25362f88b889a78c0d1fa5b57c3514b0c6465abc0075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
eb84a5629e26635bf34f1817c324e424

SHA1
d1dde0bedfb7efb951500f02f6aa70fd10e5bc47

SHA256
2118935a6934f84ada5bc62199ea104e2969be8c6df22b876988f76a1cc55539

SHA512
36dbecd7432d352bf6b4c3df3e53e58d6d977287b46472bcef02228b544d71481e849a8ff3858e0f5a1723fedae41997a9c844e917906021f798cb051a14ffec

Download Submit