1b13f4750d3da44a31d2affbaf207ddd937415b34006987227b8dd78f6598b3b

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
24/07/2024, 08:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

6af319add8f841aa0afc56a710cfedf2_JaffaCakes118.html
Size

57KB
MD5

6af319add8f841aa0afc56a710cfedf2
SHA1

177a0a478215a1009fc67121d81d749cb1f4778a
SHA256

1b13f4750d3da44a31d2affbaf207ddd937415b34006987227b8dd78f6598b3b
SHA512

726a524167ecd1b5f34f0d72bff737509c09423e952bcb0a7eda45e250292873ffd0819709464c948b04552a9bffa67aaff800a9366d86cd59695335efe6f4b1
SSDEEP

1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVroLnwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVroLnwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
4176	msedge.exe
4176	msedge.exe
3708	identity_helper.exe
3708	identity_helper.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe
6080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe
4176	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4176 wrote to memory of 456	4176	msedge.exe	85
PID 4176 wrote to memory of 456	4176	msedge.exe	85
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 1280	4176	msedge.exe	86
PID 4176 wrote to memory of 5092	4176	msedge.exe	87
PID 4176 wrote to memory of 5092	4176	msedge.exe	87
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88
PID 4176 wrote to memory of 2200	4176	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\6af319add8f841aa0afc56a710cfedf2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffda4d446f8,0x7ffda4d44708,0x7ffda4d44718
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3836 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4396 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3372 /prefetch:1
  2⤵
  PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6028 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15455273152336699128,8058719376185641390,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5100 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6080

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4704

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
290B

MD5
cfe596a0cb228bf6aa598b98a4fc474f

SHA1
99719e1eaf13524e69aedebb40eac1500f6a3ceb

SHA256
eedbee75fc7ec6a478bf4d27a6cfb4e2d4ff6c6005093f8ba510ff980f39da7e

SHA512
09807eb9774aefad985ef03c895c495e9f8ebfe45b3a865252377c42e9fcaf99395e89e91f3cb2ac2cc3d98d14a170ab7188a3f697cd76a9797740de535ba7dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
d4050f28c9512e39879c1fdb944ca052

SHA1
07a645bc9a8535e5a23338b79a905e00f2605be9

SHA256
0359703ba1075d1a734237ac25567739dc58755ce63acb4a27a43cf3b1306ee8

SHA512
46167b397d1689a854e77805a265738e72d7674e3fc3c6bcdc8a9945cca8ab274fb5266b38384d9c482584957ba6a0aabe0e45975080efe7fd07f0f190be35dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
f838b4dde77304962da7bd15298e23cd

SHA1
73f3040f5b3626b6c18d1fecc1051aad3096f943

SHA256
757f8cb7335a92c4a0f2873f192a9c3c9acb345b858fce0acff684b94b2b56d1

SHA512
369d362ee67abe1c855fa28b3e6b3f49e5b3019bf2b12033ccb46edff39905cf956e256098b83f9dc661e4b889e3c293c892c4e2b8e870f8f3d0a849b9a2ef78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6017e600a6c84ab4e29b06a021605e4d

SHA1
3386113b95afd87a74c42b39db34334ea39c5fbc

SHA256
4c1fd575d58d5ce0fffbf6a852ecd0be18e2d14a7e595020be4df07c971f1c8a

SHA512
89d4311b6cb60ceb578d9e10aa8acc7d31e2419111752680fe5253e728d19a3f6f3828b655777784d80908cfe4a22a9447c8b36ca9062ee13a58076c21d98b33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f238b9031f1c4eeedcba18b73bcf5b46

SHA1
881eaf5a8240848300b73ae49ad403efcdab14c0

SHA256
04c65dfe5a171355ae0aba17656983eb91956cc9193e3237bb633426c571f53b

SHA512
703cd37234e14858f05bc0b3fff229a748c8b5c0c85def93d6797b76ff34a365555dc90ce1f69734abab3d1a4aa328188159f5186bf692f500717341886b9c3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a836d5d6ed8c1ba94c7f8f42f165207c

SHA1
5a92f1bf39bbb6dc2b8730a4652f439adf87264d

SHA256
36665763fad5849a9ced57ce99f7ec967ccdb8827c5fefc660652bb5a5f0e636

SHA512
4f3fa203173bf6bc2204ea61cea72613a058afa8588ad67c0247c4dd533fb8c195f1d58b7154ea39b2f695b5f8e2030f302db58df5b902d490dcc4109741faff

Download Submit