b441286e71f73c7ace835d402c7049005a82c4339ccd1ad6315b58ea8de68e20

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0352f51dff5cea3d1472348928aefa40_JaffaCakes118.html
Size

102KB
MD5

0352f51dff5cea3d1472348928aefa40
SHA1

08a66b06be9ffbbe5885caa16f94072b9670e3d3
SHA256

b441286e71f73c7ace835d402c7049005a82c4339ccd1ad6315b58ea8de68e20
SHA512

370a83f7642d961dea1461f43ce0c2e8fc0c7e5a6e59f0284a98c09bdfca1276f62836cf12861e53cb6f4b9d06c57c6d4f8685fad7a50ccbceef77e480f4a79d
SSDEEP

1536:fKOrm46Bn0buc/YZLPcia6FOMYj+lhq/ebhitovmofATRBKlkHXl3TQre0bYnklA:1Jqh/iP+lsVjQkkUt2mRnwKD

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1508	msedge.exe
1508	msedge.exe
2384	msedge.exe
2384	msedge.exe
2296	identity_helper.exe
2296	identity_helper.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2384 wrote to memory of 3252	2384	msedge.exe	82
PID 2384 wrote to memory of 3252	2384	msedge.exe	82
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 4732	2384	msedge.exe	83
PID 2384 wrote to memory of 1508	2384	msedge.exe	84
PID 2384 wrote to memory of 1508	2384	msedge.exe	84
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85
PID 2384 wrote to memory of 2272	2384	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0352f51dff5cea3d1472348928aefa40_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb974046f8,0x7ffb97404708,0x7ffb97404718
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2396 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,13314949521572577644,615379558047754699,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3668

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1440

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9604ede21ad032d264082fc97566edfb

SHA1
fc33b283f724b96fd9303f434a198b8dcce1fb40

SHA256
04c73e9dfa6e3e723a8f705eb7218a54941a9288dbb5f4f180396ca2d5e997d1

SHA512
12f38a9290eebab33ca53bcee8d9b2926b65464249a9e18a48a8ae83071c092c5306a95123022d2ac5f89fce3d052493b8db28ed60d9012894c52e25eddc8053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
78c2542a0cfb56b5f980d641dd7d9028

SHA1
0ae982a0e133143868009b5bf0017d67d6f8da7d

SHA256
5999b2a4ac744dfb5615e6c7c45e4de5bcad0148c9fbc0e8e09b84452495c4db

SHA512
baee9d2bc5714d9809dbc8ce4140997a1dc646d19a756dd7a5384e5db5654982df1504459971804add6a7ee9a4bcaf38fada82c716ec1849ef3f89b530f732aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2275f7a020e639c88a6c2a183d7a7d81

SHA1
ee614067e8b293c757b0ab2be8b5ce7a4848d8f4

SHA256
466dfbaa9bdd3f8d207bebd82c73727f2c80b9a7d545caed034ceb3d14b35222

SHA512
f26ea657ab1712281e8e756cbe6c1cdd6ab6d6ff4101bae9186808a6ba68ff632a4ea16e3990c56c69ec174840b9980a74be9c893b11b09072e900a578466d37

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0904d80fa65eee753a9852f6f05b30c

SHA1
29650fedf7a2537e2ad46912c9a6836371e0cbe6

SHA256
b856808f24f04b46a93d5df32bea9596ace52b31b633cbe2944377f30d34f288

SHA512
7c28cc54a0dadccf4bf4a376c7292d582a773f2b5e122007a6f41f0f589039ab4fb7103e62e27a08b8d515302ba5b436a8af53ce8b77cbda9e13884a66e15d00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
646573adcdf996f129ecf120033cd4ee

SHA1
6886d5ac9573229dbfe9c9bcc061bf0a9a698c31

SHA256
e8730c6c7d5524476cdcbaea7fcf7f1dd6597b6a62cc43b606f2ae8941b00ddc

SHA512
94fc52b00826d85d78a7340774d6af62a4b2744cf948d948cf302a88c697b69f9f4c1ad9a8ab577dbc0ad7a7de4e2727a5560ce246d3785c296303dff94d9bf1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
41d99b171c0a317889afdf39feb01434

SHA1
2130793d3aa69c95802db369157cb5566903839a

SHA256
8937a82b44aa792649fa94721ffd833262b56432aec729d05af597eb4793cc8c

SHA512
512a1d208bc41cf5be186df63732023d33eece34bb88bff78fb899dd70923b645ac0e9e5f9f9faf1dee3200d4d4363e59bb4f3dfb73a528ea39f1093d1de1330

Download Submit