15886b52a1c198b69435ae14d620e34156474591fe27b3a35b214ff5ec64a7d0

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15-06-2024 23:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b093e644faaf6737cc718a419075d4cf_JaffaCakes118.html
Size

175KB
MD5

b093e644faaf6737cc718a419075d4cf
SHA1

22fdb64e20c1e7a0fb806ddc167ecf07e9891658
SHA256

15886b52a1c198b69435ae14d620e34156474591fe27b3a35b214ff5ec64a7d0
SHA512

473a3cab57a6b24f587457bfc3b3998bb0d20f4d4e6f0b7aa20e138faf2e34c5a9a9e20e544a2e50193acf731d23402162bb91ad0398146658d2387cc4599c54
SSDEEP

1536:Sqt98gd8Wu8pI8Cd8hd8dQgbH//WoS3VGNkFEYfBCJiZn+aeTH+WK/Lf1/hpnVSV:S9CT3V/FxBCJiWB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3212	msedge.exe
3212	msedge.exe
728	msedge.exe
728	msedge.exe
2176	identity_helper.exe
2176	identity_helper.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe
452	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe
728	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 728 wrote to memory of 876	728	msedge.exe	82
PID 728 wrote to memory of 876	728	msedge.exe	82
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 2136	728	msedge.exe	83
PID 728 wrote to memory of 3212	728	msedge.exe	84
PID 728 wrote to memory of 3212	728	msedge.exe	84
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85
PID 728 wrote to memory of 3204	728	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b093e644faaf6737cc718a419075d4cf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9f18946f8,0x7ff9f1894708,0x7ff9f1894718
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3388 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,764062587579667675,3415753711904020779,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4996 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:452

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\46f6fe20-82c0-4d35-a05b-e3c1aba9678f.tmp

Filesize
6KB

MD5
2c0a461a86bf590e8e9740e2eade07a7

SHA1
7b1a21dc42b4deaa80ca2f03f7344050062cef50

SHA256
7d6e8042588feaeac7f4bd303eeab03de0ba39da5df2d3d4023627a1744bb744

SHA512
2350561059b9f28e3e74be2068f5dec96ad63b00b00fbe9e128eb1129df4d4d776d76e7c19a6e6069f81540c147a4c678c8a8aa3c8e4c78ddeea99431d2ab03f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
4fe1287589b2c30fe3ce12a62a495e43

SHA1
c369e199345a3a2abb712c34e13c392228421970

SHA256
f4de3cb02bb24bdbc1f44e73100baf4c0f139b59cfe42dddfc1bc876d72e052c

SHA512
9fb7d85022329aa9cf6f11892d1d00c4fc316a8cfd662df06e09edd06ec92f702f6f00fa8665f4315ac0fc4acf1e2ffefa2f6eb621c11626572b50578a3d2a64

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7ef49b1c177edc786aa924abcfeeeb81

SHA1
201072af86430e037c7f7ad0fc8735edc925d919

SHA256
df3252fa23d2eef6d4a940279745d772445dd3a5384b794b082cc6d2406eeca5

SHA512
fb4d1de3791bbe1df6975974419914b5f165fe725af833e0a5b82df3338b3af39e1de5f3994b55ee7033a9ff759bf45622d5647a7f87a0aac9c2888ecada4500

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a9d7753eb4ecb2ecc0e0e68a989a7bbd

SHA1
8979ef9c1c441b78430a1d3a95d3ba6bedc88fb5

SHA256
a7795958f8ce232a4864eb43f61bc359146083ce1f82e110aca4c1e08a2f1a6f

SHA512
c6f3d31668a524b3d963023ada8c8bec095cda0692eb4f4525318366dea245dc3e714ec9863213ba0442d3808e0593b2cbe5057bbabdca714bbf230215363ea8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5bf1ce994c7268f1d7cd0f9797614a6e

SHA1
f3ce196da6ea093de3782b177059a0d71166ba93

SHA256
936eb0c444375b3189258d914033bf4edb043f749d235c65f9205743250c2edc

SHA512
24b2fcfcb0ef1570b3e7a562b497eb91f8bb4856f2ccdea531ac1cfbdc9e245bccdd9dce104064ceddbbcd3e0470791f2dfd5440cb40f11ee76e7300ca3fccce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4cc40b4ada45195db518ee3ea13b4567

SHA1
f149a4385083f958a461f2c367d08accf8ab590c

SHA256
45ae52f36651b60f27052e955958e8490e05c95d475321498a9a11fff0e61b7f

SHA512
a655066d109702d5ff72f1d0e791237a1aec6b37aa446a53b676979ab181ae6b401eb577bca865eff628b847f03648994c9e6a20ada141d5e2da61e54ef15204

Download Submit