746794b5b9488031b9fb80f77af4c8a47e63578d84fac4d329a836ee12a2ae87

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22-05-2024 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

6730e536878cf33fba3f9b4b1110ce8b_JaffaCakes118.html
Size

175KB
MD5

6730e536878cf33fba3f9b4b1110ce8b
SHA1

7546acdaa88d89002647c7bd1225bdf894a428f8
SHA256

746794b5b9488031b9fb80f77af4c8a47e63578d84fac4d329a836ee12a2ae87
SHA512

2843f03d90f2317da4c5f20db216183588e79511552334eb0ce39c8271e27250248b743c2dc672bc50e9f3c09d29ec8cd404a8a2615b8cac846844705bac4a27
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3PGNkF7YfBCJisZ+aeTH+WK/Lf1/hmnVSV:SOoT3P/FCBCJiVm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4644	msedge.exe
4644	msedge.exe
2576	msedge.exe
2576	msedge.exe
680	identity_helper.exe
680	identity_helper.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe
2000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe
2576	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2576 wrote to memory of 4900	2576	msedge.exe	82
PID 2576 wrote to memory of 4900	2576	msedge.exe	82
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4648	2576	msedge.exe	83
PID 2576 wrote to memory of 4644	2576	msedge.exe	84
PID 2576 wrote to memory of 4644	2576	msedge.exe	84
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85
PID 2576 wrote to memory of 4996	2576	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6730e536878cf33fba3f9b4b1110ce8b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8fd0746f8,0x7ff8fd074708,0x7ff8fd074718
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:1348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5556 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,16079708336193909824,12822984422362173838,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4936

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0105d433-1d36-4052-a44b-38533f24836d.tmp

Filesize
5KB

MD5
636a9c4839a506ce071789f4da48f2b4

SHA1
42cab7d435d406c3e4f4de7ff9f1058db947566f

SHA256
cd4c5635cf130f8b0b2b16e1280f0162157676b75178280bc409cb689805a923

SHA512
aafbaa37ad3e5b552b30b1a5807b46f0cfc8864c7343eebe72cdbab23c6b4cae8e416ccc8986699fdc6e1aa2c6f863033a890ef34f94cee7e0d9c29b61e88715

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96b80152-4b0a-424e-a471-fb7f552f5bf4.tmp

Filesize
2KB

MD5
92000b75dbd133a1d196724c20ae14c5

SHA1
dee319059bad4dd399f8cabbde0e36068e4b8bbb

SHA256
3d7786e11433909a5a350e1decf330b08f14795f239fa820243a4ab003fdb9c3

SHA512
7a80f59e7e10321b1c9af14207b9f89beac3f2618e03ee77c8504105e92d2585e78c11c5fe044ca39667cbf9020f947b8a0f107b421ca9e8d15042086080010f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
10576226fa125d85f59673c58a8f30c8

SHA1
a54c9e51d58d2679523ea3bb986bd1173d5019a2

SHA256
b81cdfec9233b96819eda970ed908c99254cb5a563f707765b6280fc058cc394

SHA512
40971b521cda9875e21b968e4ecc903633b0d057312613713a24e4b99ec7dc93f8345d0dddb313fd4b264bad9d90bac6e798e563c214f5c1843ba484e503e0e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
31ccb3c358d7b866ad50736a4dbce365

SHA1
adc7f0189f4edeff77ca148bf804edbaa27e5384

SHA256
e21939075e6d3a6be0e8b88e58f925ff851ecf8d90d282e71f8925c71fb63a8d

SHA512
d771eb332f2878903ee49a83d17cfd4d48b9c2033551ac2599053a88eaa8fa5940d078482586d45a7c90c5d9ca6acf8987c178fef825631b318ca1df975ad376

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
745396e3c1c3fa9be777a5acbf43fe08

SHA1
603b001f09845793098b7e3d2c1cfecf6e07809f

SHA256
de9ea3c4a98cf3640966d75a9d813916ebf1a36c27b6ef1be89e8bc5412c7b5a

SHA512
a496685c8b003a5a0a200becf981d73c5c05dfd397d45dfb65d3421145895f5464285094f04d85104f58e7c64b31c27e1998e992b8f06fb3481a7fde9a6ccb4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
c201cad6befc637d45a05a0f63e3dfef

SHA1
a33d96747965bdcd8415f45181dd28412a0d2d61

SHA256
1a8dc4dd0edae2713ef51890eb969658c9f95ab649adf300eff4dc6fb5510fa5

SHA512
81c57db842220ae62a4677769fdf778f18e6ff0b3229775130ab3702588e7bf3b4f36c12a9b867e258245fb241e7c41ff481f1345cb94436f015856d6e157105

Download Submit