c2f21a6002cce70e823231c3980c11720e1134121d089dcd5fca03eee8e59016

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 00:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d31d52fdb7685037079991d36c9385ec_JaffaCakes118.html
Size

175KB
MD5

d31d52fdb7685037079991d36c9385ec
SHA1

d2d50d421cd99b3e14d99774bd194952695c41a2
SHA256

c2f21a6002cce70e823231c3980c11720e1134121d089dcd5fca03eee8e59016
SHA512

81b7ccae6de6a711bcc35de9ea7e941c894f6cb1a03bab0508d7d84f70c1245bf33282c33c028758866ad416f3bac29ec914c858337d338b90bbf5c102916faa
SSDEEP

1536:SqtH8gd8Wu8pI8Cd8hd8dQgbH//WoS3gGNkFfYfBCJiZX+aeTH+WK/Lf1/hpnVSV:S9CT3g/F+BCJimB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2840	msedge.exe
2840	msedge.exe
4800	msedge.exe
4800	msedge.exe
3468	identity_helper.exe
3468	identity_helper.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe
2912	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe
4800	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4800 wrote to memory of 3696	4800	msedge.exe	85
PID 4800 wrote to memory of 3696	4800	msedge.exe	85
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 1076	4800	msedge.exe	86
PID 4800 wrote to memory of 2840	4800	msedge.exe	87
PID 4800 wrote to memory of 2840	4800	msedge.exe	87
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88
PID 4800 wrote to memory of 2492	4800	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d31d52fdb7685037079991d36c9385ec_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbc57f46f8,0x7ffbc57f4708,0x7ffbc57f4718
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3916 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3424 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,17863883375563961468,11188314100651456972,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2692 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2912

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2712

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1144

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
0b36775af2538bc553b7185ee5109c1c

SHA1
b5f9e0afad2885638bf79307af77e4c2e583c4a0

SHA256
cb310e7a4d0e95923b159da24ef2cc457cba97eab6294e92e42bf966754b6a26

SHA512
b109fdd41ead95a696563379122d7aa9f82190aae046f769246bd6fd8d96fed733b9377e7bfe15fd5f9599251ce0f7b3aafedd3813b154c54803eb28a0dc28d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9da707a58c69ef5bae90a7da3b187bef

SHA1
eb8abe8511df5404d399474b04257fb5e6eae533

SHA256
5a2d5f57c49a017d44edfcd2050eeb46ac3434569ad61d1c60acee5f00e1c3d5

SHA512
8e8e4c9ec728be646f4f6dea7c7edc33d838c2337d751d0ffffb3826ba0d4bbf26d4d292c1350acc8dea443be5b0d02b183b5f9a76f20dccd47ae6668d504322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
0622aa20e07f341c29d311e81dcd05d3

SHA1
3976a4d4d709710bcc7f4c14207f5bbccae51c6b

SHA256
4c7f67a23d078c8c41ccfe985aeb55da6b4f07d94bc974761c72b8b7462abb56

SHA512
3408ee238dea9b9f4907e3e41e3b41966d97ec31c8e0c1ed07dd00b825056c00a8cba4a3a8f0dd0bea11f222c14868efd24bba856a5ad65f97cccd2ebd78703b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
33ff86a1499d191c54c89084d8031500

SHA1
442481e0279972aece224ab65b0886b0a509d868

SHA256
9a2fbfee845481de6ca548c69dbfbaf3a5241db139ee8c4adf8af11a51fa9546

SHA512
ddf4ff4a9aa2f080e583b6aec8c32a63bcfd70118c7a20e9abd02642e4a6fca6afada95da3e9504eece9340bc6ee41bb8444efe09313b161e2dc9d4b132fa3e6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b654eb1b808815742fd0bfb02a49d617

SHA1
862f64eb4281ec4d81ede744dcf0d283821248ec

SHA256
382f5297625eaa40d0870d57890d15835940ed962edb0940cee977720e2005da

SHA512
c0a28f8500ce60bc8dbb58499462e8c16843cf7bdccda1e0876b60efeac9069f68efc18480a4f883c6e097e9132ae833b764d0f6a001e6ebca3f07d2f896c61e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c905b3bf34de24acfe875b98aa2a4df4

SHA1
8663696811dd338703736f832066b92cef42de88

SHA256
c9c09e845324cf195f40b83a7ebb9716f8b627053e313f40e7688902cd437d22

SHA512
cad4b6157efadcd6e8ce5d3f092a4c21c3b19e345fa076977ccb37188249abc141dc308dd1962936efabb2bde53e1bddce37eb7d6a35126509ad5f6208cd8064

Download Submit