dc1b9894d15b18a0b9d399b7b7bc7c36584e1161c93a7aed8c49ae7a7be16f18

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fbc0d20f55ed3211d48ac751eb517b1e_JaffaCakes118.html
Size

71KB
MD5

fbc0d20f55ed3211d48ac751eb517b1e
SHA1

0d58b83836a27d6709da62a3a38d9fc0cc146489
SHA256

dc1b9894d15b18a0b9d399b7b7bc7c36584e1161c93a7aed8c49ae7a7be16f18
SHA512

afc0102edad187a422de608d5d71ceb5f1e4d2a5b0a883faa173d70dfb308db84e735388f2c7d718aabc518f4ca6f2fb8623d690babd7b89b6863dcc7c10ac44
SSDEEP

1536:SHVfsvqCqRm9/FJaVgmoAQYhB9/v7RwjWgmetIO4hjI/9KFGekSx:S5svqCA8/LaSBjOzdgRtIO4hjkeGekSx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1952	msedge.exe
1952	msedge.exe
2324	msedge.exe
2324	msedge.exe
4920	identity_helper.exe
4920	identity_helper.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe
2324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 4836	2324	msedge.exe	82
PID 2324 wrote to memory of 4836	2324	msedge.exe	82
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 4964	2324	msedge.exe	83
PID 2324 wrote to memory of 1952	2324	msedge.exe	84
PID 2324 wrote to memory of 1952	2324	msedge.exe	84
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85
PID 2324 wrote to memory of 464	2324	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fbc0d20f55ed3211d48ac751eb517b1e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e3a546f8,0x7ff8e3a54708,0x7ff8e3a54718
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2112 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1328 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2236 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1832 /prefetch:1
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,1060419351689950130,3407481807845213742,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4528

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4568

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
83c0f5352c481c2f42ce7bfcec8c72dc

SHA1
eb40c5694cfd5cf038719e7beeb83fe704884a95

SHA256
6f1b830d390b916c304c819bbbcce6fc1842ee9af07ac36b132d6a7c805a555e

SHA512
b6eadbc5d873d79df488041f9d05046c7f53fd218a5056ad35d587d263b6ddb58648b0cc5b966ce285c1f5ecba04fe3ea194808e581c3768493a52834ba5feb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
183B

MD5
5c1019a2fbbae64fc4028cb6454df74d

SHA1
d20fe68f9ce22bfa8c0b745a9766ece9609b58ea

SHA256
ff935fcbc416876bcd99dbdb408a834913432c5a18f17d8586f5301874ac6a75

SHA512
9eda61ceb453cf16e4aa8654fc73223f4c1c10fcbcc4459449fb4da3d21b452b7c81ca1a3f1a633c18d21894c3e902ea1ed1ab27a4ce2583c28b5ad0562ff48f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
514dbf2664656ed137bdb71c90bf8c3c

SHA1
3af0cde6b8e287e66f0e58a7a74e63e3c5ccfdd3

SHA256
88f64248a2df0c3600ec7bc7113fd4111a8dd235258ad28b291a6584445c15c1

SHA512
3a46588963dadccb27335aa68d8a2904a80d69175a6d88711c04647f88a578eda3e7f9dc9bc049c416fc2ee9c7532808b3438486aea7b87fb44d6517670404e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
224e6a65f8a2a9cdec6848df220c6a7a

SHA1
01dbcc835bc4b63ef362fa7673b52c8f745af89c

SHA256
607aa1d37b9ad2b8c4d162512be6aad82753490a64284cae42a6a9dea9b8b0cf

SHA512
24500ca98605d89d75128a19da81930923c95859e58ac74209c83f57fa489f00e483c7c5597878960ad38a15cd0d4738ee4b3eae34c3ad7d2e5af2d4385023c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
df5bc7037e52e80317231d9171bb9939

SHA1
b4e47d0445e356af57eedd7093d1389cf3cadfc2

SHA256
3e4230f6aa42ca2bdf7be6f210b1bba741cddc3e358d16c8f92120a11210bb04

SHA512
06fa98732c26229b131221ad83bd62e605ef2c78dad0c4ffd57c479b2e44646d4e04dd0cd0f691e484f11a9b666fa193f749211969e6eb22ba10e755f159a1fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
525B

MD5
2ddddd96dbca3990aa3084ed78b775da

SHA1
797623f1fade190b14c8a7c936b5f861af7c88f1

SHA256
56b6399099732b441d34262b47da120bf05dc32cfa29b3c3447712be1e954907

SHA512
24f14d9db918bc3f7c3e1a578214f191734ea3483c94d8495d69ee98222e39c60a3c1dcad5088d3a49abdf02c1f0e16b06bc0b07714684318bb5965bd07b17e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
525B

MD5
1b8e629be365cddf2ebfe73accd19aed

SHA1
399433006f80aae181892f85dc509eda2f49712d

SHA256
185918412cf3320f8756b9f40dff216f86bb42506575cc28366cf041f451ac9c

SHA512
8d8fffa94aa7f0543f738539fee7914953338a2fe01fa246c8e1b140e5c1d2035f5abf081ab216c30c177a54a1f5977bef9502748353385b74fbb3dd25811a4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe588ae6.TMP

Filesize
203B

MD5
f527581ab59b277b9ddcdd92d4ee8602

SHA1
b0e1d4667fc92b5ef88721c94ce20a06826abd00

SHA256
52a90d5c14005cb57218591a642ac6514aa14fbb1314b14dd2f7313bbfa40454

SHA512
14f5035cc12a6b7aca779fad703330d66e307de36f49248a6c3dc22593c322a129b6ddccaadf81b4aff7c20afd1ed30f3c4de857980664127e7d34d602dd724e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e1bdb2a422d14d66a90a82f6d0a4cb93

SHA1
34dc6b1b914e327d5b4b0699768b766df26f1ff1

SHA256
d9d4c9a7fb22c209bba81ffdc62a0240d210f88e1a69f2c13b4f76c4bbdb514b

SHA512
45c7d4cf4a7c6e203db238490a759480ced03dabb22552045a1a57e3c935d9c2bfeb5bb164a014ffea3b073dac4b0e8fdb2d9b9c17b067dc58ecfdd161c5cc3e

Download Submit