96f1b923d7a91e313698f6f061400800a7045d7524893e32ae8f089f593aad0c

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 05:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eaa626744ce94a668c514ef6526da3b2_JaffaCakes118.html
Size

57KB
MD5

eaa626744ce94a668c514ef6526da3b2
SHA1

50c323c7e62a7e137aa569cdcf8d855b3dfda197
SHA256

96f1b923d7a91e313698f6f061400800a7045d7524893e32ae8f089f593aad0c
SHA512

17bb5b29a91b34c52eb963a65910630bb0ecdb06e2bdf997a917ee4c019785549fc09379be785a9cb8ef62f192d715f3dd03a73df9b061e6f78ef470c8ef74a1
SSDEEP

1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVroXDwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVroXDwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1256	msedge.exe
1256	msedge.exe
5020	msedge.exe
5020	msedge.exe
2664	identity_helper.exe
2664	identity_helper.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe
3204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe
5020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5020 wrote to memory of 4856	5020	msedge.exe	84
PID 5020 wrote to memory of 4856	5020	msedge.exe	84
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 2556	5020	msedge.exe	85
PID 5020 wrote to memory of 1256	5020	msedge.exe	86
PID 5020 wrote to memory of 1256	5020	msedge.exe	86
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87
PID 5020 wrote to memory of 3096	5020	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eaa626744ce94a668c514ef6526da3b2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe5df546f8,0x7ffe5df54708,0x7ffe5df54718
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,15097554269151803937,12385226062813036742,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4600 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
816B

MD5
5307801f32e16971f3af034fbc1a0aaa

SHA1
e4e2ed16ce28ffad51ccc6ceff94361a6623c4c9

SHA256
4c21ac2289dee347d2c3c9008d6ae43e7dc5e813dfa4160f16c7e3db1e82ba61

SHA512
5686aaf441e3bbdd0b038033c2c4f0aaa8b62138ed72fd688e3568df22b92914132a549e8e21222d1ac03e81ae02f72e57e373c7be05bd2d4801e9a46647c412

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1120d5cba398e1fc8b6360eb5dc193f3

SHA1
da8fd9f384ad9c699a92a371188615ab5174761c

SHA256
3f60d2dbd27c5168868a341edecb3b18d8dcb676b41933313693bb773d645ece

SHA512
e96055682c5f96528141b81ecedf113e4ca571f83774e4f23ca47cb0f3d09cbb4d5c88d1622e9aa9f749593b018b6126b8eec3ca9d877637a8abb673bca9aa9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f0f781b4da947f1a347a1e16747472bd

SHA1
700cd9a4eff17cf8f417eb5eea6002a320e6eca6

SHA256
cfb6e0d0f6b507b4383c2c69d14e4f177acda103d5a1bffa15ecc5f8dc3b453a

SHA512
bc8a442e672a956d8ed6b4c4ccfe3233c4340dd32a2a3a1fc9b49279bede32693914a9308084dda26a346d8151072005767c18b48daccfe114bd32223c3d08bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
822d558fe8d219f0352d7e18d14d775f

SHA1
fd6146b8321f6415fe9f13395f27e0b926a06703

SHA256
945283b686ebd46c89b0d44da3d57e91774334a1e2871a047584ad133e72bdf7

SHA512
bb046418675ecd0fae6a07f9d2ebc4589908e049f457aea7d44aa6d22e33631b97ed27449dd2c83c01ee1736ec5d56a4b98d8ee670dab0816d437bffd4491c26

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
20c22eda016f781a83b834254ad60a82

SHA1
cb9afefbeca9a272fe3fb73da174f1637df830fb

SHA256
bb627a0e86d82c2fd1ceef741cc1ba69cbaca29715bcaa3262e353edd3b4cc1e

SHA512
a35940eaaf4d35f9321707c8b15b74cb8fd6127e3f3671afd19dd18ba2093ef635a25f2b3eb288bc16afec398271612e019efec5f234d41119d2858a08657b58

Download Submit