b6ae167bc7a98a16120698f2f11452449118662dd3f1cc88e6ef7286465b45ca

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20250211-en
resource tags

arch:x64arch:x86image:win10v2004-20250211-enlocale:en-usos:windows10-2004-x64system
submitted
17/02/2025, 11:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Videos/READ_NOTE.html
Size

3KB
MD5

d2294fc6905efe047a0663b7ffcf79d4
SHA1

9bf17f976f73ec0ce4f05dbfdb5d4ebc9fc1f2d0
SHA256

c459e80d8500c3db9810f63f835e5cc1e4f08cb2deda4832846edf1eac31e1dd
SHA512

983e14d90fe1f5c4993724e1d8ae57132ccda5efc62f0d14146e36c8982d0315753c6aa573f97c6f7d29136051e65eb85bbe9a02846b431a06b5e71ec1ac8a28

Score

8^/10

discovery

Malware Config

Signatures

Downloads MZ/PE file 1 IoCs

flow	pid	Process
60	412	Process not Found

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MicrosoftEdgeUpdate.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3076	MicrosoftEdgeUpdate.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1016	msedge.exe
1016	msedge.exe
4024	msedge.exe
4024	msedge.exe
2016	identity_helper.exe
2016	identity_helper.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe
4024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4024 wrote to memory of 5104	4024	msedge.exe	86
PID 4024 wrote to memory of 5104	4024	msedge.exe	86
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 2136	4024	msedge.exe	88
PID 4024 wrote to memory of 1016	4024	msedge.exe	89
PID 4024 wrote to memory of 1016	4024	msedge.exe	89
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90
PID 4024 wrote to memory of 1868	4024	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\Videos\READ_NOTE.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb113b46f8,0x7ffb113b4708,0x7ffb113b4718
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2944 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2272 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,1360173075944203048,17007345766385920056,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3128 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe
"C:\Program Files (x86)\Microsoft\EdgeUpdate\MicrosoftEdgeUpdate.exe" /ping PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0iVVRGLTgiPz48cmVxdWVzdCBwcm90b2NvbD0iMy4wIiB1cGRhdGVyPSJPbWFoYSIgdXBkYXRlcnZlcnNpb249IjEuMy4xOTUuNDMiIHNoZWxsX3ZlcnNpb249IjEuMy4xOTUuNDMiIGlzbWFjaGluZT0iMSIgc2Vzc2lvbmlkPSJ7NzlGOTE1NEUtQjNFOS00NjY5LUJGNjItMTMwRDk5QjQzNjU0fSIgdXNlcmlkPSJ7NjlCMDFENDItNjBBOC00RjBFLUFDNzYtNDVDN0Y4M0NDNTNCfSIgaW5zdGFsbHNvdXJjZT0ibGltaXRlZCIgcmVxdWVzdGlkPSJ7QUMwRkU5NzQtN0RGOC00RDBCLUIwNkQtMjE0MzA5NEM1MUQ3fSIgZGVkdXA9ImNyIiBkb21haW5qb2luZWQ9IjAiPjxodyBsb2dpY2FsX2NwdXM9IjIiIHBoeXNtZW1vcnk9IjQiIGRpc2tfdHlwZT0iMiIgc3NlPSIxIiBzc2UyPSIxIiBzc2UzPSIxIiBzc3NlMz0iMSIgc3NlNDE9IjEiIHNzZTQyPSIxIiBhdng9IjEiLz48b3MgcGxhdGZvcm09IndpbiIgdmVyc2lvbj0iMTAuMC4xOTA0MS4xMjg4IiBzcD0iIiBhcmNoPSJ4NjQiIHByb2R1Y3RfdHlwZT0iNDgiIGlzX3dpcD0iMCIgaXNfaW5fbG9ja2Rvd25fbW9kZT0iMCIvPjxvZW0gcHJvZHVjdF9tYW51ZmFjdHVyZXI9IiIgcHJvZHVjdF9uYW1lPSIiLz48ZXhwIGV0YWc9IiZxdW90O0UreGJBejZZNnNVMTI4OWJTNnFsNFZSTGJramZCVUdUTUpzanJIcjQ0aUk9JnF1b3Q7Ii8-PGFwcCBhcHBpZD0iezhBNjlEMzQ1LUQ1NjQtNDYzYy1BRkYxLUE2OUQ5RTUzMEY5Nn0iIHZlcnNpb249IjEyMy4wLjYzMTIuMTIzIiBuZXh0dmVyc2lvbj0iIiBsYW5nPSJlbiIgYnJhbmQ9IkdHTFMiIGNsaWVudD0iIiBpbnN0YWxsYWdlPSI1IiBpbnN0YWxsZGF0ZXRpbWU9IjE3MzkyODMyMzYiIG9vYmVfaW5zdGFsbF90aW1lPSIxMzM4Mzc1NDI1MTE0ODAwMDAiPjxldmVudCBldmVudHR5cGU9IjMxIiBldmVudHJlc3VsdD0iMSIgZXJyb3Jjb2RlPSIwIiBleHRyYWNvZGUxPSIyMTc5ODYyIiBzeXN0ZW1fdXB0aW1lX3RpY2tzPSI1MzMwNTAyOTQ1Ii8-PC9hcHA-PC9yZXF1ZXN0Pg
1⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
PID:3076

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1af47ff71a93ce65b67715d8eab1463f

SHA1
f7cb1fe4b76f2a24d12acbe5d77d8e69b766245a

SHA256
d4e05a41fc65aca28648d51d557db9494dcb31c484c150a851d0b3369f18821e

SHA512
4826974f8d9e8280dc8329b8a43d18199909caa2e425de6a4583aacd71f94228a38688c26b0c6127fee13168e518457f50f0769d25215d9629f1c681dea34e7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dcf6c443f82d4a5f87e2682853b2f355

SHA1
ca4623dc0bc7b7bc4f31dc0dd8834ee743fc357a

SHA256
30d0d0bb11a133f7295c839c78a88d72324d9e279b9c465124ee5d50299b7a86

SHA512
b9163bb08cafcfbc8e0e52d6cb7ca72c5137ff5347c0a7c86787478ce979c3390f355f9f1ece9be1a8fe5df9b94dbbb1ae574b0cc1b63959ea630157765e11f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
a23ad09a005d03093426d57943958eec

SHA1
706a9b434a5be453d22167351c7405ab76027485

SHA256
be3fa07c9293b4574804cd7bf97693a7989cf3481a15b628e2247dd0fcfbabf3

SHA512
38ae3520341e8b2d87cf099ecb74e71ab52dea565336962eb4d1d2371ff3db86caafe6de5dae873dc598ad495ca27476683e3838eeef51db5d6b094961ecb73e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bbac842c038a302a0f86e3ee7f547b93

SHA1
2e43573c9e67cc3dca4f91edd85ac47bbc1b5386

SHA256
f4ab87cb0c966ab4fa9978c1e4bb306b0f43f699b52674768eaf3800ef88f654

SHA512
3f66fc595288a5865d8038aaa1b833355919d387bdab020c0ff710d43aef671efd22bb336e5a3faed8cc24feb0077f83b4c81c475003787fa29c33c6c9b3ffd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14aafa53e6bf51a42a155b38a6381575

SHA1
69d5f4083ac03750e720c06b461649a8dcba83e2

SHA256
d45e245c04a3f4eb075d1390984ed35edec3f5607cfe227b8d9d8fece09cd0bb

SHA512
157bdd44f57b93f0852f0ae208bbc6ff46007cf662e69eee1cf53f27582c9985371870075726f8eb78ca3fd4485990413a0266f50d4c50401ac474378d5270c1

Download Submit