92fa13660ac11c8c40d150be98f86c8052f2654cbe5561b388f73f4531acf73c

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
06-09-2024 17:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d007fb6deb104de58eb62136d5a54038_JaffaCakes118.html
Size

182KB
MD5

d007fb6deb104de58eb62136d5a54038
SHA1

714877f63568c57b42bf3fe59446bd131803f29f
SHA256

92fa13660ac11c8c40d150be98f86c8052f2654cbe5561b388f73f4531acf73c
SHA512

8b94bdfdac6cccad1bf598be2f15f7ae3f189d7da151344741a3d3f0f6804a15b44d73bb0e73c95638f193ec8d085e86f0d41c6270657cfd7d279de065fcdfe2
SSDEEP

3072:SIvfSj0j0Ht4GfVA473SWmUO3Bd3iyTPj4Cd3kGbB4GzN28y5pYTaOiHLOykfL2f:Srgjot4GfVA473SWmUO3Bd3iyTPj4Cdu

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe
2672	msedge.exe
2672	msedge.exe
4280	identity_helper.exe
4280	identity_helper.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe
2672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 2988	2672	msedge.exe	83
PID 2672 wrote to memory of 2988	2672	msedge.exe	83
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 1540	2672	msedge.exe	84
PID 2672 wrote to memory of 4248	2672	msedge.exe	85
PID 2672 wrote to memory of 4248	2672	msedge.exe	85
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86
PID 2672 wrote to memory of 228	2672	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d007fb6deb104de58eb62136d5a54038_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8996946f8,0x7ff899694708,0x7ff899694718
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4820 /prefetch:1
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,2009184665595421176,9579850701018364381,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b5ebc80f9e0142709346525f0b6d8856

SHA1
4f4f2a3c6bdd0cf64e30835abecc3e4b86d01175

SHA256
00ec087ba7e67dbb7d69b229fc796cb464ad12e8521154d57a7956d65ad7248d

SHA512
713ff6e5d434c1d42338ddbd40b0fe689f17af271fd30078ed845f87e6ed30512a685b35e511cacf8cbfd157d032c4f57859cbda2e85e612d5a81b16df2a5168

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
49a8d898d5ab444fcb9025ec54d78d6b

SHA1
bd8fdbe344ad374ef91ecb2dd90369e16dc0b446

SHA256
57b075fae671c7a7bdb0cff8f29a2f728e2a17a7bfcd9df573c664d78858a6a0

SHA512
c0d07398453c76c41656f62a72d65992d3c9f61baa56b7ff8cdad36e598cc6d9d16ad0a4bca2cd5d9d323a9bcbd13a92b2d037db508667655ae7ccceb465361f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ddccbed3c808ae88ee5358aa21184849

SHA1
46248134dbd01cf22367936118ce63c45073dd7c

SHA256
dbf8264c6f27f41dce2fa2195633a429c5d4c4067810d554d03f7f58c02aafdf

SHA512
b50d9b3957b32c0ba50ad2808cade193ae32acb60c55b25ef200edd84c4f025e802fdbf4b16d6839b77424fb8098828aa33d81a6294ed37cb15b9cabaa90a1ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
0edb82c711255a2474c8427aed5fe699

SHA1
916b27a2843b2e768756fde45f33351c65fd8520

SHA256
91524466cef77b06a3540a3e5bd3811e0efcad8d90b06d3568c2d838ff4a7d48

SHA512
55f0151f05b4bb277a18d11ffc176ff1974f86a8bf84f28b9a51b3e68321fb8b3a9c16008316f2a40295d09e6cd8aab0e341f9044589b40533be189bcc9c3ab6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1104f2a2be50288c4f016a82819cef2e

SHA1
a5e43dbb810390b429d0774d651fb622e5a81dc6

SHA256
ffa08a608857c1d94b803791b2f896a7a0acda5707f8654e8b09314ffca8c30e

SHA512
633fab5637e380356618022f81dad4b0315ac677bddcc370ea591c88ca43e7585ec2f547d9077d325aa99225f9c7c21bf6af765a7e8c293eb277950f5348c823

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6dd16aed502aafdd4134559743c89f94

SHA1
40fb228ee6475357a2e47ddccfba546e8e45cf11

SHA256
490f7f609e7486c9b3e0f14aafc7813be73399ac0ad53b5ab967b8545980497d

SHA512
0fd83d9d73a8bbf6a70b545fc9fdcac0636e333aaca616a1ba9c3d19315200bed744a1417c3f97a90f8f792356c23622c9294d478d2e0642e93024fa29a2c761

Download Submit