6b87b256755cd1269182db15460deea1ad9ebe706bc6c3bdcbd4be4c43e1f36f

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eac9d54fa33b5a33758727ea20788439_JaffaCakes118.html
Size

175KB
MD5

eac9d54fa33b5a33758727ea20788439
SHA1

bb179ebc33ad957c1177554e218663cced72f6d9
SHA256

6b87b256755cd1269182db15460deea1ad9ebe706bc6c3bdcbd4be4c43e1f36f
SHA512

adbedec99f3423053aa7487480519130570f3c01ed139a007c22aa03308be9111c713bfeadb147da592a51779b9c3b860291213d48e7499b0d4e8f757a94aeb4
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS34GNkFvYfBCJiZL+aeTH+WK/Lf1/hpnVSV:SHCT34/FOBCJiSB

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
380	msedge.exe
380	msedge.exe
1068	msedge.exe
1068	msedge.exe
3232	identity_helper.exe
3232	identity_helper.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe
2504	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 1396	1068	msedge.exe	82
PID 1068 wrote to memory of 1396	1068	msedge.exe	82
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 4924	1068	msedge.exe	83
PID 1068 wrote to memory of 380	1068	msedge.exe	84
PID 1068 wrote to memory of 380	1068	msedge.exe	84
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85
PID 1068 wrote to memory of 2692	1068	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eac9d54fa33b5a33758727ea20788439_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe746446f8,0x7ffe74644708,0x7ffe74644718
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5784 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5848 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,17078823059860830957,11205607499634020225,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1992 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3192

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2848

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
857b4d5fd3db039aba7fed5c505f4de8

SHA1
8bb6b8d947810b79f145d6f78b924b755e91b078

SHA256
99eab0c637d8b835cfc0778d91f7d299370eb055b6c22ce58b5934aa4175576c

SHA512
be8616113e1a19f6ce68dd7e7365d5670210a259bd6175fc1c03bff572f4df6a2af0ff90e04ae93351921eb3f1f26e9aa52e6adf90e810308a3769897cfabcab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4fbebfa638fa576e8876fdd926b813d1

SHA1
e46bd5c84d8c5dff804cc5cb6b325404e8b1c212

SHA256
f668501e7ed94fad26cc70dda0459b177412af6d035113bf1ce37dbdb0ad1229

SHA512
79124202419a347771c707701f8c8793bc3336989668c4021cb1fd26f124a609c9cbe91800b33d06a5bb4138c42d7d6d0c880bc8bae8676987e3fd8d6a3dd633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f881666a93d48d60f5ecd6103973ea96

SHA1
b21d9960d7ed72385c28b056c60c2867d40cd1a7

SHA256
971538eec1fb6a3e38aaec2a0e71918f961cfc98752f61b15df324b5eff96134

SHA512
af81dcfd15efb4ecf245772e1f18808546fb528bb3f8464b67e584aec9386e95d6ef3e38fec7e6b6e74722c2bbcf695b938f934b928aac1aa4a90c5e09cad44b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0ae4a2fbbc016ab18d2058ab717008e7

SHA1
964fcc02c821c08825d284e5580520e5a35a39e2

SHA256
b5b7b4a69b768765ab7eef3ec12a88369cc871c9c145fa6b91c8a7c1cbc11ad2

SHA512
e76968a3da9d1b2fe68a17c32061adbd72043572646c9afb71f446e32763242af9a0a893f205d9a847ac1c526fef18b0eb52cd37cbd1575017673a17c4d4a606

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
15e2ef5a20e57be8f5b6a7b01d5291e1

SHA1
d8d023d9405662cd3128bb73bcfd893c0cc2183c

SHA256
d34a81daffb0a2eecc62e922e5beeedcba58afc1cd622ca0a3a6df6a5c2e9ec7

SHA512
dd24ad49c9741a6f8a58db7c2d0fbc658e0c894996ca74f4bba6cd142fc783cf797e7296ed88170db6768b8c38577204aec6ebebc5fe0f83ef1a92d00fab951e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
976e4190de64f840b9bf473c030be5b7

SHA1
b34fb5912e2db04895c09a60b985bdb10c724403

SHA256
26d590f36a3340579e9012191e5b95d569bc4d585af30f966631c59fb22fe74c

SHA512
8f291803fa175aa242b248be2881a23314503344e2ec5db6b6690d2355c53a4d7725f636e212221f135ae970eae821a8b23d462ac9dfd6604cc4ce4d65f32c4d

Download Submit