92723b9f2008d9f5ccedd1107b201eec494f975853d45988b1c9f68b9e2944e2

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 11:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8a445cc1cbad5bbb1f0fa79240a297fa_JaffaCakes118.html
Size

14KB
MD5

8a445cc1cbad5bbb1f0fa79240a297fa
SHA1

e6f37a50c7d8e1479e6508cdc15f6bfca6ea22b5
SHA256

92723b9f2008d9f5ccedd1107b201eec494f975853d45988b1c9f68b9e2944e2
SHA512

c3ec5a8659fc13b17f717898c7a4cc815b9e93b2421347ff8028e0ad261131e90689d8fd41bcbc897e0e71da224ee0d4630bf83a1bca5d6c6046cb9f666d1902
SSDEEP

192:NQ+hF5jc4eO1q4pPYGk2fg6Gp9e4wzOCfQZM9fXKfS7rB5kGSjbH2dAmlmP3KTA5:Nddcy11P2R6GzHwhyOP7rBVSnHIJ2

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe
3372	msedge.exe
3372	msedge.exe
3444	identity_helper.exe
3444	identity_helper.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe
3372	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3372 wrote to memory of 3680	3372	msedge.exe	84
PID 3372 wrote to memory of 3680	3372	msedge.exe	84
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3648	3372	msedge.exe	85
PID 3372 wrote to memory of 3000	3372	msedge.exe	86
PID 3372 wrote to memory of 3000	3372	msedge.exe	86
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87
PID 3372 wrote to memory of 2236	3372	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8a445cc1cbad5bbb1f0fa79240a297fa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b8ed46f8,0x7ff9b8ed4708,0x7ff9b8ed4718
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2588 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6204 /prefetch:1
  2⤵
  PID:5128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:5136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,11616248233817641470,4542222476281033784,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:228

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
210KB

MD5
48d2860dd3168b6f06a4f27c6791bcaa

SHA1
f5f803efed91cd45a36c3d6acdffaaf0e863bf8c

SHA256
04d7bf7a6586ef00516bdb3f7b96c65e0b9c6b940f4b145121ed00f6116bbb77

SHA512
172da615b5b97a0c17f80ddd8d7406e278cd26afd1eb45a052cde0cb55b92febe49773b1e02cf9e9adca2f34abbaa6d7b83eaad4e08c828ef4bf26f23b95584e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
478e88f9e6e065af692d52986159c5c3

SHA1
766f3c23cc1d2f3bd1e98be86722358bf66aef73

SHA256
2888196965d409ac2e7c7b966c9058f9682a0da5df2df79ceb902ce77d8ce3bb

SHA512
8250437ca7f36c622b19747d2c4d95f079fddd4350fc10620c52eb181da8d699c94bab6a5cd25c8f579dc31d0ca03e20f90cf45139648cab8323cd41d40266e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b09b37258398bf7769cbdd295eda1023

SHA1
4c868c1e3b2b98e709b628767e677592c4629465

SHA256
bff65a2499bfaebb1eef21e2f778314ef6c0afa27fddb0236d68b40092303bf1

SHA512
c807833fa0a45ab22045992a85d1a2021d45a76540e669ffe7dbc5be7883543ecffda79aad69e4a584d564f1ca3da93b4a1c06ed3b499395c8d0002267a5c26e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b7652e2f7e616bbbf13fe8463d4428c6

SHA1
3f71b26461354e6afaf8e2be142455e5c45cbf07

SHA256
e1830063f9710c02d4cf11c26097f391193e63aff98dbe5338035f3fc9fe6e07

SHA512
a72902be52ff1a560ab6a4322fd411c8257afc21f9ea901fea25eeaf53cd2462d9330731837de38ed0b6b72cb519b884764f3137ea236ec42e54ad8bde30412e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
073fbddd8524effcdd21460eed70f20b

SHA1
86fc380cd3828c16d689b715fa2bf9cf238c0bd9

SHA256
23a862ca0e7e27dca14e6765e475bb6c1e9dfebf7658b612cecdd22b4edd517e

SHA512
12633937079ec160736b423d18ed039f66bab73d9016c622bb129ebd2a3f8fdfd5be8681ecffdf255f11319cdcdeea0b2e6240deb4d8f0d8fdcd96b21f70470a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
427c3ce6916708a400c864d794bec269

SHA1
66c338ebfc560c587228f15be43c09e0c8824147

SHA256
f7657ea5c6e71e3cafc9af9e1336422d1eda957091dd1a1c3df010f837fc41fc

SHA512
8d2b6579222865c5be10b77f181f4745960c649c7cf4ac412f26339945aa7c08c06fa227257f6fb0d067ce7b70aec5d408c0a581eb79050af37b6704e8a49c1c

Download Submit