9547f402bb6f3fc90f252eeea6f2999c375e1125f76728f31a93e64309bcf068

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24-08-2024 09:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

be5371b620ee20fbe3e01ddd57fa9220_JaffaCakes118.html
Size

89KB
MD5

be5371b620ee20fbe3e01ddd57fa9220
SHA1

850b81a38a0fbaa5053ffc5d821dcea4dad48d55
SHA256

9547f402bb6f3fc90f252eeea6f2999c375e1125f76728f31a93e64309bcf068
SHA512

00dfa8a1bbf82aaae4710db593ae0e0f920c15a1406354981599ec2c03fb631dadc46c212aa27935a86a20bb4ae10b573bdc8d824974940ca5ad6a12de65f765
SSDEEP

1536:jBrpBrH9b1oT70ceNWe6VbeBepeaoeHeQeSeQ17SlE/DZaMkvww26rvStUw6W:jB/9b1VJIVpH/D02E2R

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe
2992	msedge.exe
2992	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
4836	msedge.exe
3232	identity_helper.exe
3232	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4328	2992	msedge.exe	84
PID 2992 wrote to memory of 4328	2992	msedge.exe	84
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 1056	2992	msedge.exe	85
PID 2992 wrote to memory of 4188	2992	msedge.exe	86
PID 2992 wrote to memory of 4188	2992	msedge.exe	86
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87
PID 2992 wrote to memory of 8	2992	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\be5371b620ee20fbe3e01ddd57fa9220_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd490846f8,0x7ffd49084708,0x7ffd49084718
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2180,4442104968900891309,1200920550052969916,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4844

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
04891a2aeaf5fb0e8ac6be096d0c6031

SHA1
41c386f1e48d16ff5f322eabaa3ab257b5b50d01

SHA256
2965eff135393dddb1dcfd6d8c6d3ff56f98719ceec34237d20efca0a0e1595b

SHA512
22ef5e5c1307ef811abd341824d32083209d9be52bca8985353e19cebcd4f06f31cdd1c053cf8cb1f2ba6137456cef8a9128cf33b893bd7e95e7c834608eb171

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4bd485033b1593041939cc45e684124a

SHA1
7fd886e385e35c6e7cdb6b4a9810a357d54cf2bb

SHA256
447ab34f09923c28df069c08fb7f9bf5a64007151949f0dc9d68fe46a56f33ec

SHA512
f1a350f3386beeccf35492087215ec2a3c37b245eaae0827971006bbbbad2b31dcc1545471068efc5326e668e64bf4934ee69d9f09bf0e612d556df0b20f433a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
aa0a084089c536cdd7d1b7d1f3acb2ae

SHA1
ef4280f47c2748dbfc00d6afa6ff4fddd3a8ca89

SHA256
c2942a18629374d67bb4b93a874a73540557cf8edf183769bc911704c1377c25

SHA512
c0dec6d75665870215eb19dbf1026776103ed0674b5045d1138ae94d61ad93b23233cf07cbacab686f8601f559b98d6e2938eca503bff786d20ffd3559fbe5af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9aa999718d351cbabdf8cdbfa05e6212

SHA1
7eafaa2f46bc5e93c4ca8c325757a44a61f6d761

SHA256
aa24724900f777fee93cb137049c2e13492378f937d18bb230b1452d6d69fcc8

SHA512
2ad64335437f90641d1617a05a8c4675a3c30b8c6df37b95d9d63ee395fcb49be759b9018369e9703b4186ee4986d74d44f0e66630719d499f53892f5e0bf167

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
af0e452e6b817c5a68d93ee4c2064ada

SHA1
6b05f25a36697efb5126eab22950b5ef177a67b7

SHA256
effbfa9392a7d859cc4546ad8cc8ad20b9d22e08c5b95ada0ffae0194c4cf20c

SHA512
6f8fa3581c9f36c07e7455df13546b33f8de7a572047cfb7a172c367001c738834a6e04dbdbc1df1d890f81c91da7bcb054f795589561346991c0908bb101ee1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
266cee9c80c27efd9a56949696e88c98

SHA1
4c11f4ef65f7795e529e5cef363c66e9c73153d1

SHA256
1c20e05e0c12888487744e62836bba5f8d5be9684a22531f4f3a718cf950e808

SHA512
6bf8d3d161277d556cb1431e6181bda86aad652d330e8731109e808ff36bfa00a4cc513a6842240bdf3d36c1547da02018ae05e1fc77ac2742be53caef2920f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58cdda.TMP

Filesize
372B

MD5
4bf1a83138bd34aa8cba8947996382d7

SHA1
2803383a4d7cb380b7ecd4ca3caca6bf6643bcd8

SHA256
688cf300df7412b9bb2bd20fcd0607712ab04fb0fd8a40c4540a59bf60dd1be4

SHA512
ee93d8075e2b657a91652de05828db9474bed6deaa9ac70d41dff36339da3df327cd01216f90ead663ec35bacd8e3461b1aaad423ccb4a21ffee427cba0feb13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
82722e4e2415f2c4253ba35317b59934

SHA1
d6a48dbb4d0cec11aac556ed5b614824571156d5

SHA256
9e1cd6146c0c9ee2299b26f9f4b8327a18eab73c16d9a9d5dbc04309c6319071

SHA512
117c5fb5be0bf838cdcf6c97dc084d462d98abe78cee91108dd5a6abe80ddf52b20e4e8bc6340626167e45da8b3b7a457a42fb7533b1051a2aca521815f3ceb0

Download Submit