c1b2de88f1e7bb04b3b72fb3bb509392298a73e1aeb3b516b21a0d65bd4db7d8

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 09:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb148e9d76c0283b3bcaf63d3852814e_JaffaCakes118.html
Size

175KB
MD5

eb148e9d76c0283b3bcaf63d3852814e
SHA1

3600252f5e65c724e35e0e093a14467fca71719a
SHA256

c1b2de88f1e7bb04b3b72fb3bb509392298a73e1aeb3b516b21a0d65bd4db7d8
SHA512

90e84fc6a2186285683850689b69fbd9edfff4878ee2b5a817a9048b757a13608e37eba1d7201d03e38f616527527fe72d818b278da8605a47ff01f0554debcb
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS30GNkFfYfBCJiZo+aeTH+WK/Lf1/hpnVSV:SHCT30/F+BCJizB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
836	msedge.exe
836	msedge.exe
5104	msedge.exe
5104	msedge.exe
1660	identity_helper.exe
1660	identity_helper.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe
3460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe
5104	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5104 wrote to memory of 4380	5104	msedge.exe	82
PID 5104 wrote to memory of 4380	5104	msedge.exe	82
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 3604	5104	msedge.exe	83
PID 5104 wrote to memory of 836	5104	msedge.exe	84
PID 5104 wrote to memory of 836	5104	msedge.exe	84
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85
PID 5104 wrote to memory of 4356	5104	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eb148e9d76c0283b3bcaf63d3852814e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82fc046f8,0x7ff82fc04708,0x7ff82fc04718
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1988 /prefetch:2
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2872 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:2468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4208 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,2004039696728376832,17441674660821956046,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1696 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3004

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
c132bf902f043ddfcff24623e3fce3af

SHA1
033e4c7fb9e1c1ad4e5b9de596e975c6efd71ddd

SHA256
dd1b466056a91bb1bdf7b0d2ab8fef5b08008b6f9777ab41581b2d633953959e

SHA512
d63d70c5cc666bf46af97f1c69a4c271b9dbfc7ab298fb30b5fa7e72db1cd5d57efc711bbea1e3cabd68481137c0afb6c6cadd796784d346e69f187021775e08

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bfd9359d3151bf78130495172f65fac5

SHA1
a8aacb2af22a151e6bafe0067a7fc9803e1f9706

SHA256
9a65afa240ac523951a7ff1a8cd2a15d348d201a0a5fb34a775e4db86bac9f7a

SHA512
89ec944a8894cd26282370b48a91e86b460d49f031f0188711cce6c5835f01217fbec30728b4f578c485874a2d4df022758cbd325a5cdf7e3dacf281ca57f811

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e717447db08c33bf6059b684b30cd11e

SHA1
4dbce3ff20387ab9a71a0085b8bacc5e323a6b9f

SHA256
a457c11a7ad4aa04d7e2b70bd622ea001a800654de610e91e624fba0f4f8ac32

SHA512
23a116d4033c1eebec93b8a7a2c2f7797f7b249a01fd427fc85a9d7121f9e8bbfebd5e7551f11be5ff7ef8a2d2cf617fb2a4d4ed7e09809311c9dda1d29b0ff3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6e6dceee969c0fe563107acb932b3942

SHA1
97336db4b45d00e0f5e8ba4e9d4aaba0f0ad8e2b

SHA256
5db4c47eb5c62e7b82d86c21b67e784941df5451b47d7280412b9ff33a6de41e

SHA512
81b0d7ad05b8b210e58d97757fc3b59f4ad50cf1c3215c1162b9e6d5bda99a6107e8ab5c1ca594a397cc1ab236104ba587a72e47ab8c826296d95c47077f0479

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
32a7f0f251b0eb774145c96eb602ccec

SHA1
29438624805da29d22f3f37bbd79bb694965296a

SHA256
e304f5b752782f6db1080cca301e12db2d205c02a99c0299157f1dd7fad571c4

SHA512
132b3e2e29227f7bd50ca055a07e0d4886097afac18b99a7295a1f655fc3a8d5bd9aa8b2048af8a47c945ad23ee5db7be52781abbbbed57526d9ade95c6f8c04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c5cb48db2be833edc9b5df325c200297

SHA1
88ada9cf86da18d99244071d5b77635474d2b2f6

SHA256
da2528c9bc3fb58ffc9516caf0bc88e0bceaf488d40ce14415f5d73795454329

SHA512
f224a953dd966689692447f602999b3f603d61d692dd44600b51106079d2dd4f01c5e0a228af62635f5296c4d1f898f38f95b321eb27c1669c1ad23e7be3a3fd

Download Submit