59f12b4ffbfaa820354e7288323a55dbe423938d43c26d4b3d80706c1a90d3c7

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 14:29

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d2269c9351fcb4708e8afc4bb36c4dba_JaffaCakes118.html
Size

3.1MB
MD5

d2269c9351fcb4708e8afc4bb36c4dba
SHA1

5fb9f754b6649646fb7e026cd02b3a8ba5b3941f
SHA256

59f12b4ffbfaa820354e7288323a55dbe423938d43c26d4b3d80706c1a90d3c7
SHA512

a64490fdc703146db09d9966054f45589a4e9116b032a9b68cdce7bc0e3cf6557fc5b98006f60266ca36cd8a4ff67979961486b83431f799126b4467b3df3a2d
SSDEEP

1536:0wdUj+DFMC4PkojtGaDslk5U2AmzTr+7ageyzZI8bTRA72Z2EY7KlVo7gjsETDWJ:0wUjt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
2868	msedge.exe
2868	msedge.exe
2448	identity_helper.exe
2448	identity_helper.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe
2936	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe
2868	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 456	2868	msedge.exe	85
PID 2868 wrote to memory of 456	2868	msedge.exe	85
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 2040	2868	msedge.exe	86
PID 2868 wrote to memory of 1612	2868	msedge.exe	87
PID 2868 wrote to memory of 1612	2868	msedge.exe	87
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88
PID 2868 wrote to memory of 3444	2868	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d2269c9351fcb4708e8afc4bb36c4dba_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdcac46f8,0x7fffdcac4708,0x7fffdcac4718
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5836 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,547455713660122177,3859681380291704533,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4876 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3460

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
578e242f4739141ab11af7f813b0c44c

SHA1
df3e7b123aec2a93d12844c2bb562f2db7aafb68

SHA256
ab3085057ca09e1a91315e6ed2b8174f83f3de297c510d2080433228a09f9cb0

SHA512
d06e43ed543639b058ef18af3a3c81508aeeff6e13d3417bef95260ee651c87033f6e1a8444278b54618a0a8a7beb5a04805831b7fdf3bc547bc0ad49098d582

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
715B

MD5
55ec2f1e47af01fac8a48b7797246bb1

SHA1
5f128cb306494b749f71f6fc744463b7b16f08bb

SHA256
3c454d304bb1bd6d746beeff518627a4356f9a9ab3d7a08e0ec99f1df1718536

SHA512
f1f571ef37e1c77511fb0759705cc36377de8112133763d6413794eb12c2248180accc2432af634bc7345205eab1daf9f07a38806428a77d5c35dc33c09c7ab0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eba8002378f206bb181a457aebc0968b

SHA1
2eafae1ac434a052b4ca1f9518994c833335a3b4

SHA256
5eff714cf8b8152422fabe00e344aaf82b1d2cf9563ab5954773ba9fb3cc1798

SHA512
b14ac0389032d72dd97cb1f93d042404dc7d6250c3e19d890864753f1b5f9eccf049432cdf9aeea4db50f478359c3967872994560cf296d44dde5b468d958f79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
37038befd6e914e2169fdb3daf72c7c5

SHA1
3e9f387b4d1c91814f2949e311a82814ae272da0

SHA256
44728a3393ae4eca15254c7a3149111485147a9cfd9e003f12a9b6192617da13

SHA512
aeb9a4e00a6d27e48a390f410a8b86eb28c47640f71bc08f7ec92a86900c01a49f3764ce935e23f238a015d0f9f911974c6862f11580476bfb671e274137681b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
824d3a76a6f7b7021a6603adc7b386e3

SHA1
14fbeb879e890fd8804fb714d27a9e9d8a236a28

SHA256
68a1952a6280deed1c3693086d1d90791d66d27408c1bfe4ec014fd4b0b255c4

SHA512
b2d1de58110e99d61af6be19bb648e3c2c550bf607b5bf33e9c03e2222d0d34c0f74af9beb3e71a1ed5f592a5c5c151c8f61a2aab2290c42248d4bb86d293de9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5849a6.TMP

Filesize
372B

MD5
a258eede4071aa051c4cd592958381ff

SHA1
75349e6cedf0b4bb97c5eabe8934f713300e484f

SHA256
4fdf8f8030d054685f76db9f2f96cc868b65fac196820128d942512d947e1ca2

SHA512
9b8cacfa2ac9428b81d79abbe1e033a0bee0def609484d1b0becbfeaf504feb2f42a6d9c8358ad962799a37b208d7c8a371c21c29f1fd9f0d7d847f056190085

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
448e667b9d784bc4a605a15874d38b14

SHA1
02c2928f004c637513f7665d62a1e37ca99c17b7

SHA256
a9e61408f72a3bed110cd92772243a0630338ef244b162c55131c1ced02ada4b

SHA512
514e2760e04fb8ab5f10a2c690f9aad7eee7ef037df529c0017e4bf9094ea09c1ad013a99771cefcd149641e590dc48b4c6d213916162a419ff7bacd5ab8a325

Download Submit