5b0462b23668e8f09fc262dfef35abb63e3e70ee4ab3b70543d8d9dada26457c

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
09/05/2024, 20:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2bab32009cb03797d02dcf12e18e8a6a_JaffaCakes118.html
Size

107KB
MD5

2bab32009cb03797d02dcf12e18e8a6a
SHA1

013e23cf37fcd0e7b62f3cd24bec97fbef06b768
SHA256

5b0462b23668e8f09fc262dfef35abb63e3e70ee4ab3b70543d8d9dada26457c
SHA512

02f04125cd6135d5618ab6c555b0dd6fdf496f37bd3aff55a07c30dec62d03784ba98f9bdb525d5e4a04c712e0c674778e3dd968dd527477b4727b3ecf7b5628
SSDEEP

1536:vR7tKY65h65h65h65h65h65h65h65jzqH0:vRhKY65h65h65h65h65h65h65h65o0

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4788	msedge.exe
4788	msedge.exe
4752	msedge.exe
4752	msedge.exe
3248	identity_helper.exe
3248	identity_helper.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe
336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe
4752	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4752 wrote to memory of 2880	4752	msedge.exe	81
PID 4752 wrote to memory of 2880	4752	msedge.exe	81
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 2056	4752	msedge.exe	83
PID 4752 wrote to memory of 4788	4752	msedge.exe	84
PID 4752 wrote to memory of 4788	4752	msedge.exe	84
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85
PID 4752 wrote to memory of 1240	4752	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2bab32009cb03797d02dcf12e18e8a6a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe676e46f8,0x7ffe676e4708,0x7ffe676e4718
  2⤵
  PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1716 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,2693075618619331431,632269700451826523,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4872

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4032

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
199KB

MD5
585ac11a4e8628c13c32de68f89f98d6

SHA1
bcea01f9deb8d6711088cb5c344ebd57997839db

SHA256
d692f27c385520c3b4078c35d78cdf154c424d09421dece6de73708659c7e2a6

SHA512
76d2ed3f41df567fe4d04060d9871684244764fc59b81cd574a521bb013a6d61955a6aedf390a1701e3bfc24f82d92fd062ca9e461086f762a3087c142211c19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
09d83ec498fa2cf254cc50b427dfba5f

SHA1
1f844610ccf8089b5898c6f049d4db6e63f6742b

SHA256
53612a8bab46fc5cd77426bab6227faf53b6d0c0ed9d63a6acac6ba4de8db12c

SHA512
5356bc8195e0c0722ae8a865ec4d3801a2e3c19fb4d8720374cea4ca9b5f4eb99b35a565eabe17becd164fb0b962304bb60c103158a3c4d5e5fcfc2a3d8b83a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ce0ac0af0e49c6c0ac4c9e2ba840b8fb

SHA1
8eec9b71a1d87c5f0771aec8127447d7e9efbf73

SHA256
fb58ef67a56440e53eca592703e1518b9b7de7ac523d2cbbaff9666e2fa1221d

SHA512
46d91fe2b15c33e6b2809470370db932d5aadd89cd15021411c03f6d3d380b73125929864dda0f7c0d484bb74c4d1ae1767841cd6c63cb2b2157af4d85ee9905

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eae2b4ed22a7abbb63e3390005c8aa1c

SHA1
723a84670e1bbbc13ede8a6688bea678e19db0a3

SHA256
403c5eb700df24759ac18d0735d17ae79bc7a15c366b2164b33f28c0e94ff96c

SHA512
9e3ecb3ab65870b963e9cff5976cdfc794bea7df23a0668d793fa984f84a5c02e7b2260714de9d9da95260f2c971fd74b0ce695334379115dd806b04cb0408e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
386967b122169b2053bf23308d182efc

SHA1
5ab67c7fd4b0849f0d0d486e2dc8bc2a209e06e9

SHA256
12d7db56fcfaeb1813670c3f57d98b6e2dbfa7cb433cb265a9317fe6ae994f4a

SHA512
16657c2108e5d9378416383691ab62d2b3da2a8bea1ec8a5b13ff0d3a26893714aa2e777299a9b2139a001fbd8ef9286e8b456f631ae116bbd7b929506588181

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a4e5e84b05c5b199c92154ec9841aa90

SHA1
45dc3df2fc6d5e95135087badd5fb7ad2799106f

SHA256
66f4eb7b2bb154c0ffbd0f587b76f8f64049207c04c5a4cdaa936e61e3af0bb6

SHA512
efe090b3df92c4c1ea922392ad670fa4042da46228b8c2aaa7df7a67c32e833aa60061c354f573e15977324d7e750ce5356961c8c020c0ea47e4a714d9cff5cb

Download Submit