c29cab5249666847e27a3f1ca303e295ab185efe43cb966fbf4239d9bd8edcc5

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21-08-2024 10:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b3243d33ed0cd1f360d80f2f0d09f59e_JaffaCakes118.html
Size

56KB
MD5

b3243d33ed0cd1f360d80f2f0d09f59e
SHA1

9a2a42e2058b89905d2cda0369b626e85552874e
SHA256

c29cab5249666847e27a3f1ca303e295ab185efe43cb966fbf4239d9bd8edcc5
SHA512

234af3b8ff65901e6c3931bd0176a1fc446b5b1aa7ef08e4ea287ce68f0eb1490e77c0286e3624a4b40edac4812f762f014564e6f3e47572c6a111806b68389f
SSDEEP

768:Zcd9QZBC7mOdMoHpC5I9nC4z0obKVi/HU+bPd:gQZBCCOdT0IxCk1x/PbPd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
884	msedge.exe
884	msedge.exe
3824	identity_helper.exe
3824	identity_helper.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe
884	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 884 wrote to memory of 1672	884	msedge.exe	87
PID 884 wrote to memory of 1672	884	msedge.exe	87
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 1028	884	msedge.exe	88
PID 884 wrote to memory of 3204	884	msedge.exe	89
PID 884 wrote to memory of 3204	884	msedge.exe	89
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90
PID 884 wrote to memory of 4264	884	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b3243d33ed0cd1f360d80f2f0d09f59e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe5ba46f8,0x7ffbe5ba4708,0x7ffbe5ba4718
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2192 /prefetch:2
  2⤵
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6136 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2124 /prefetch:1
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4088 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,3640558958310687789,9684647778399265245,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5308 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
89b88a58444f80822b9e1a7c86459021

SHA1
46bf093ef1015923801f2b480c01a16555a7ceda

SHA256
2766db91edddf885928d754e0626420f66b11953aaee3e9a18d4f5b15a2a740c

SHA512
70e1be1833f403eb2e1b7330d0c2f6a8eae2604319295d3bcf872b0da725c6ec660984713d0b4a8a83fb07dee8b967888dd34e1c36fc69c93eb160184cee2924

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b4e8a13ca13645e33b825af546e65633

SHA1
48b57b8cf5757436c831ba3f8d41d3a2c327baa8

SHA256
dd094f731ec8628d32cf28d26709f999c5480f28c2f10062dbc20e48d8e9785a

SHA512
14db905ceccbbebd9a499b723e88f03ff528fa8328d270e5b19ed335e7562fb43e09e198a533cf8c3b725a807a3d52a34414c7e9f694106eaefaeaaee5843de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f8b6fdc815378839c23d213503075d31

SHA1
c0487eb4bff5ceda466fac327a5e9bc5e6f7b942

SHA256
56c70c8260488f118f24d35fe21a56a25770915e778138af9b3b66854f3fa11c

SHA512
bdf3af0f4b5b61d6c74a4d8173b352aa351328dd842995cc7657e942bcf6fd76c9daecd0cd3c219f30d874105454c2df2576a7512ab94f9cb5a9f3f110f480c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
930d10ec0e8764fe39e1749162bf165c

SHA1
ecb70177ac1700e7a980908fc5d70d7d0b4d4682

SHA256
aca3c33a4826058e4a1a376abf865a5812530fb90a863d2fb8bf4703b4de8e42

SHA512
0de95126763aa0e15181f4273484fb23c5c2ea594b458ff9d4d9b7f54ee41135156eef93d3bb3d498612e11f20837f61e088e91e95fa4b9b473e3e1b1709095a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
152ddc3997d60ff241168965ed92355f

SHA1
a978696290d63d2d520acd448a9c434a5269d9d6

SHA256
5fb9bb9b321ae95d7b9809483d80fc8939b3ef9771e8060225dde1add1055b95

SHA512
0a2839d5f89cd05385f7bb4532a5192be2e03392518466f2e7a4b7605b88582c3d1f425ec5bf6f30ab456672d8226bd5d67562fbff8e7d5b34ac074722fde037

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
494a861dfe3fb61b7f6e9a8e1f92d179

SHA1
903db9c91a888cdd2a359e921ea2c1a958228aa9

SHA256
46ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690

SHA512
f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
04e7c035e01412715fb8444a64d8677c

SHA1
d31b205ea15e043a9b7e879401fc4e7e56bb24ca

SHA256
a3ddc7c09907d59f4e012e73bc0efc6404c0d0184579a260853816857e14bd58

SHA512
872a15bc0215ec53b7daf82bd23a8602add7cb7158fd6afbb88d2b04e8f5b02e41f16ef347bfbefebd54d1c9e12743172cc61f3843b86cddb350fc0579dcef8d

Download Submit