89ead4a38dff59163642010d88ce3cea4392ca823c621e94f639432d779e1b23

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 09:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8d9c0a79c93fd71560d5502445319716_JaffaCakes118.html
Size

175KB
MD5

8d9c0a79c93fd71560d5502445319716
SHA1

4b10fc645ce2fbdf783791918c9bb4d47035ff19
SHA256

89ead4a38dff59163642010d88ce3cea4392ca823c621e94f639432d779e1b23
SHA512

a024f337541fd7a5f4b2641721fc27116758be0dc4d5c6c27873d9a06b881152519091338cf449ecad54408b685f592bc68dd90a64361aafe01e20b73a3eefdb
SSDEEP

1536:Sqtd8hd8Wu8pI8Cd8hd8dQg0H//3oS3MGNkFuYfBCJisM+aeTH+WK/Lf1/hmnVSV:S4oT3M/FHBCJium

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2280	msedge.exe
2280	msedge.exe
4296	msedge.exe
4296	msedge.exe
4052	identity_helper.exe
4052	identity_helper.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe
4080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1480	4296	msedge.exe	83
PID 4296 wrote to memory of 1480	4296	msedge.exe	83
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 456	4296	msedge.exe	84
PID 4296 wrote to memory of 2280	4296	msedge.exe	85
PID 4296 wrote to memory of 2280	4296	msedge.exe	85
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86
PID 4296 wrote to memory of 2968	4296	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8d9c0a79c93fd71560d5502445319716_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6dc846f8,0x7fff6dc84708,0x7fff6dc84718
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2492 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:5188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2997491633485823299,2156927860269640037,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2132

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4884

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
3abf931b79527cc4d501b2c54ed595e4

SHA1
b548b2edf9413fb6828ac124f3a202111f7a55f5

SHA256
8493341c35b7669b3ef1b83848690a13e7089d750514eee83c9f700318de2d07

SHA512
e88a93d5d22bd9244ed58de266f1d0f862a0b4f65c48a3a4f93dbad6fa725ab3579bea3b8e309165d951d937b554241c2704d4dc9548f2c65e540a5917ab7011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
16575658e00f7e6a86c9acccf21f3130

SHA1
af90104cc4550773891548f2149348833a416f14

SHA256
ee2c5df6530c8a01d682f61d20d9c5fb8c23f3995ed665e314c736a4e5dc0f40

SHA512
fecef90cb7f62ce2e0dd76c505dbe77b550f26cc636c786e6366398971b235fe8f46f54781916d167f699c799be5f2e17e7041da7606ce3d79fdcef8f6f6ba09

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b884a7d8ece6eb2ab9e846704524a78c

SHA1
42de62b4d9b4a5a46f796e53d85f6634ac353eee

SHA256
7901fa15a770af93bbe677a7a9f5c0fd5a7fca3eeb4bfa5eea3439e872246197

SHA512
f1b2627d2d59887428e508d2cbde297c9a74934163200856b82f87e91489e5c922d97d411d607308ed549956212c12fd63db8975da66a51aff5d0a66085937d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c47c9a4fb90bdc5a72239c459e81bd92

SHA1
935e14e04ce0f0b4591e3bb3df0dd8b5ff6084b5

SHA256
ddea0c5cccb4a1abc197af3bb8ed35b04bc1946aa5a1bb9db36a3d9f27289ceb

SHA512
090922ab4e6ee807f5270f573c63bd10fd21dbd580d911d45ce43b38f067538ca90dfe6da56418990512ef0d6a4876b87dbc765560a733cb7722fdf60dbd8440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
50b1d8bd3c9d25a25c48a7ae8876d4b3

SHA1
95341d7121ea5fed8a44e76bcbf7da77407c6d5f

SHA256
949ae3fdefc1311e172327c3491b4ebedfb9f299b802cef895ac38dfc675c281

SHA512
53589a96597984d42b61f10ba2e7a5e37ba44ee432d385cdb731979d5b944a854a4e937a696f07d06a43910c9a3941cabe2e0bbc3188cb8bff3840db45b5ab04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
59648c82b6615153920a6b6ba899397d

SHA1
c0ccc82e387c5e0e97f592f0e58abcfeb549ec4b

SHA256
4e38dfdd400c3fdd6d3cbc9344d363c4fadd51de59938de05cb77fcb6c348611

SHA512
c853d28125928e0b5108c71f3a6bed886ff6fe62cbc169652c7a427740b2e147a155a7f6948a8ecc9c958240ecfff43b420bf1a3b4e27601520413827892a83e

Download Submit