ddda993876a820af741d390973dcfac315b4f6369cf840ecf263754e37147554

Analysis

max time kernel
147s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
12/03/2024, 13:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c36dbd7c1712fe407b1bbaafc72d1024.html
Size

14KB
MD5

c36dbd7c1712fe407b1bbaafc72d1024
SHA1

c14f8244436f150f9d069c1c766ed3afb4c6f909
SHA256

ddda993876a820af741d390973dcfac315b4f6369cf840ecf263754e37147554
SHA512

49a9876e01c34a945a1e02fedd4dbdc85f24d92fe04b352497ec6772d95456ba5bf1f71dec3dcd72ac9fe2aad8c0ce8db95f10f913244ea488e7c580af383a8a
SSDEEP

384:1ZcJvLhQyCX1mOEtrW1qfEOSxhmKpDxx2V:HcJvLSyjW1qfXSxEKpw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
1420	msedge.exe
1420	msedge.exe
976	identity_helper.exe
976	identity_helper.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe
1824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4508	1420	msedge.exe	88
PID 1420 wrote to memory of 4508	1420	msedge.exe	88
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 1556	1420	msedge.exe	89
PID 1420 wrote to memory of 3320	1420	msedge.exe	90
PID 1420 wrote to memory of 3320	1420	msedge.exe	90
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91
PID 1420 wrote to memory of 5028	1420	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c36dbd7c1712fe407b1bbaafc72d1024.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb5eeb46f8,0x7ffb5eeb4708,0x7ffb5eeb4718
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2420 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4460 /prefetch:1
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6092 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5208 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,11312099735061661196,5387368888908068741,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1788 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7c6136bc98a5aedca2ea3004e9fbe67d

SHA1
74318d997f4c9c351eef86d040bc9b085ce1ad4f

SHA256
50c3bd40caf7e9a82496a710f58804aa3536b44d57e2ee5e2af028cbebc6c2f2

SHA512
2d2fb839321c56e4cb80562e9a1daa4baf48924d635729dc5504a26462796919906f0097dd1fc7fd053394c0eea13c25219dec54ffe6e9abb6e8cb9afa66bada

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5c6aef82e50d05ffc0cf52a6c6d69c91

SHA1
c203efe5b45b0630fee7bd364fe7d63b769e2351

SHA256
d9068cf3d04d62a9fb1cdd4c3cf7c263920159171d1b84cb49eff7cf4ed5bc32

SHA512
77ad48936e8c3ee107a121e0b2d1216723407f76872e85c36413237ca1c47b8c40038b8a6349b072bbcc6a29e27ddda77cf686fa97569f4d86531e6b2ac485ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
194KB

MD5
f5b4137b040ec6bd884feee514f7c176

SHA1
7897677377a9ced759be35a66fdee34b391ab0ff

SHA256
845aa24ba38524f33f097b0d9bae7d9112b01fa35c443be5ec1f7b0da23513e6

SHA512
813b764a5650e4e3d1574172dd5d6a26f72c0ba5c8af7b0d676c62bc1b245e4563952bf33663bffc02089127b76a67f9977b0a8f18eaef22d9b4aa3abaaa7c40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
02979dcd18a9e6253e8184f639605ef2

SHA1
da3f98f7c2a162b2fb774cf90052981c0ddd090b

SHA256
f4c40c2675adcc0410bf99cb6c250f65c2edceef5c24820fe5a71c4cc08b68a2

SHA512
d3c82f4a3ba7fa19a25fa3e8b452434eaacd76eb2af5537f3f789e6bc86342346edca6767f75ad0b294a6e24c01dcfd55316937107e51b456a1ffde4314f1755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a3cc4e84c4f8b45a4f1b9ac68d0001e

SHA1
8e371529dbd4c5dab3846965305574dc345e99b8

SHA256
57ccb1c73cc49f5524d3c6b5aae7899b3373ba1adcc50aed8e1c0b01ddcb5f9d

SHA512
9b29771e601bd9dbf1861be12c264f24859d1e1a773a79388fd1371d99bbda16d4aa20ac45872a9949a63675e750efa7bc063b681f0093394a23a0337bcae8f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
90e53b7db2f44c7904433ce105713ef1

SHA1
f66a49f3935ec99c399318249f9a451d3d927798

SHA256
8b35e87436055f34d8f6ab8332e125be6c5a48b84703ac35edb2eb7d30219de6

SHA512
e9f33020351234f36cb688ed0b43187ac05c98832b891b1b6de769373c1f2582df56ba120249e2edd88e84bdd8b1024a024d2f973b0d7f1bf9932ae6aab6eb0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df09bbb4fe7b74adfcd93428986e8374

SHA1
1dabaca6a4ed9d76d6f87aa67c70b8efa2980658

SHA256
29951eab0f6d6a091f5cf78b026d8827801181c056fe711a93104e4cc45e918d

SHA512
51c56fc7da33e4f4be1542a82b86aad14493ac5da789756335e6214e9767beb9798d59da52e54a37679f1d3184be7e62851ee4d5647522edae2516cda747b290

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8b119b6c7353c6fe7ced819e12de4236

SHA1
7ca9497ca80bf328a71d3c4d4fb7be6bb8fbf6f6

SHA256
b0200b55e5151d48175c6d77a348665fe403b21c365f0134794442ff93c4cc50

SHA512
8fbe2ddae083fbe0965da2a1c855af84746a14fe338a817825ff7156112734f51db2cf59f1eba5bec6c16736b73b34ba309d83b60712b0b8d4e3b070fdd45be8

Download Submit