fc529afc0fd01a551dad744a7cfd55613f957ef7152f330caaa3e79d5e69f2ed

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 23:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bfb2b3c8bb70c0f7a581db019c927a68_JaffaCakes118.html
Size

175KB
MD5

bfb2b3c8bb70c0f7a581db019c927a68
SHA1

96c4d22bfa262f84e55206c47603801af241138d
SHA256

fc529afc0fd01a551dad744a7cfd55613f957ef7152f330caaa3e79d5e69f2ed
SHA512

2084b9b28f67583e891315b58e0d158e2c1af08f48f9a303fd6cc5fae47be1b04cac38130e315fe094d486fb9ba6e92dc379909f8e2c41df59590d3087963c92
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3rGNkF9YfBCJisW+aeTH+WK/Lf1/hmnVSV:SOoT3r/F4BCJiEm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2076	msedge.exe
2076	msedge.exe
3792	msedge.exe
3792	msedge.exe
828	identity_helper.exe
828	identity_helper.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3792 wrote to memory of 2144	3792	msedge.exe	84
PID 3792 wrote to memory of 2144	3792	msedge.exe	84
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 4388	3792	msedge.exe	85
PID 3792 wrote to memory of 2076	3792	msedge.exe	86
PID 3792 wrote to memory of 2076	3792	msedge.exe	86
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87
PID 3792 wrote to memory of 4380	3792	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bfb2b3c8bb70c0f7a581db019c927a68_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff815d46f8,0x7fff815d4708,0x7fff815d4718
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2152 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2596 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4800 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,2049622769458124300,5618177279589228435,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2892 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
0377dd66eef0757ee32ee40b7262e39e

SHA1
999ed6deeb6b65be0e1852d13aff151625df76f1

SHA256
b7f769992839607a57cb1171641180c6bf248613ed31c7d29e4268df40d33046

SHA512
c991f68fc90d1303b876c10ea302589f48e255a9346163e476f11ec1f2d62db2832eb8a392bbe79e964e52b34ce99074e38ba900fc4d9a7f284963f2f2acacdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bce5f3f194b351e56d6fb5dd13c4f007

SHA1
a08bd7d4555c53c702b6fc8fc38e6e6bb5dfcb2c

SHA256
88b709232024108f542f5ea83f5d6e381464636d09c0c710f3e481bd8d58f3af

SHA512
352d41720022a0504aed3deed60295ffefb5e13328c585191c9a833979ace56d27f243e2b6df34d46e6eff773717daeec234b0a8cad9da79aaa9b863a2a1ac46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a395bbb616ac850808821a023bb7f638

SHA1
1d3ae5d38a941122dd53b366078d593e64ded7f8

SHA256
d31011d436b39a429b1d033ad11ff805dfbb769608b7acdc878dc31d55398ae9

SHA512
1137c4dbbc7d6f9d09e5f292d5629ef6b7360dd9c3d85e4ce9abcda0e9fe9497401b1bdfff74d3b002c93589f68edfeadc0101038144f23e6cba8ef790fadbf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5b57a5eef8555baf7e157aaece227176

SHA1
71590ac61e7f82c7f32a3510ee68f689c3f33e7d

SHA256
219ba61a4af207beb4f5f1e9b55344612a8740898738d606b8bb5adbf9a00944

SHA512
fb254e99a390abeb1e1813f286915fc61c3e2bcbc3adb62a8dbc9db53add7efe192b2f46a71bcde05f5d7e1dbbabb8b0f45ad3868e169d488e90d8eb786c6b3b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3385ae9471e88eda40c773c357339543

SHA1
2a3de13274e70836810c4113c786e9e08273fa2d

SHA256
3a6f634754699cf330b2c558c144ad8c394cf6d12de11e33c011aa71e501cf4f

SHA512
a476244a35bb7325e894ec626677a9c493dbcbdd413b51b4ef827df8630a89d00fc5f7554cbeadfa3c10bc336099bed6834d66ab49ff83502e239d1fde795c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b8113278eee3d3a6e39fcc4288b0364a

SHA1
65d0ea2cf5eccfea91971d5f7ccfebf179b0b920

SHA256
8772159abcf4f4530b525d22383b5ec7b295210021308fbf324b2b88d3966de0

SHA512
9f7f70d3971b42514564e30de3ba24be2644641cbe96e77dfe68d48b29290b94a6446972edf8ecc15abb0cf36b0ab90496d62f4065ffd062da5f06b1ca3a0d27

Download Submit