7f97f1829dc21f5e7e92bd7cc3c8858be5d5028bba2f7e8f028af9154a6aa435

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2024, 00:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

0d0eb83be2ad2cfebb76068e93de181d_JaffaCakes118.html
Size

21KB
MD5

0d0eb83be2ad2cfebb76068e93de181d
SHA1

953254471e3ed2fe8d78f28223e530ef9ffb7fae
SHA256

7f97f1829dc21f5e7e92bd7cc3c8858be5d5028bba2f7e8f028af9154a6aa435
SHA512

2fb87835842f2cac4731ffa838d3bc2cc92fb017e2154337018d4e7cdc7128871d07ae05a4b141d7dbf4b2258bede7bd0bc238a54d17ec25c77dfb45e111105b
SSDEEP

384:LjNWcUcQ/AukKDpxgWhHoVXXnPRfyUWi5eKlV5nqh9j2V:YcUcQoipxgWhHo96GV56A

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2344	msedge.exe
2344	msedge.exe
2812	msedge.exe
2812	msedge.exe
904	identity_helper.exe
904	identity_helper.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe
3964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe
2812	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2812 wrote to memory of 3528	2812	msedge.exe	81
PID 2812 wrote to memory of 3528	2812	msedge.exe	81
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 3932	2812	msedge.exe	82
PID 2812 wrote to memory of 2344	2812	msedge.exe	83
PID 2812 wrote to memory of 2344	2812	msedge.exe	83
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84
PID 2812 wrote to memory of 4828	2812	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0d0eb83be2ad2cfebb76068e93de181d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff83d7446f8,0x7ff83d744708,0x7ff83d744718
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:3932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5988 /prefetch:1
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,11490560475012529750,15983924089239025611,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5188 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
213KB

MD5
f942900ff0a10f251d338c612c456948

SHA1
4a283d3c8f3dc491e43c430d97c3489ee7a3d320

SHA256
38b76a54655aff71271a9ad376ac17f20187abd581bf5aced69ccde0fe6e2fd6

SHA512
9b393ce73598ed1997d28ceeddb23491a4d986c337984878ebb0ae06019e30ea77448d375d3d6563c774856d6bc98ee3ca0e0ba88ea5769a451a5e814f6ddb41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
7f1348cef7134452fead05f0e206e40b

SHA1
ba449e4688513aa5a2eb4825d5db26b242d29ecd

SHA256
967e401d8e9d9b8fa16181f7aa42a23d22261c6bb478207dfeb4653c4fab9f10

SHA512
5dc9f795ea6090f5355c1d3b0f8e85383b46a0eb4629ee9e07d6ce621dcc0dea7bdf5d33575a313fb354821fe292cd76be174d9be7e0bd553cfc07aacd55a85d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
07af80e4995c02c35573902c821e983c

SHA1
f1ab85b6ed22257e2e2eb0ab1df7558f7b61b56d

SHA256
8e4843a0f440b4b452f92aa8aaf5385c1ac2cbae19f1fd88ec320fd317203103

SHA512
aa32b2044d15235660b07ede532720b3174fd24e21ecec011cbf8fecf1609444e37c84c3651eb441f3c42235e9663541b9de52db152db9e369fd3e02ec975de3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
249faff7702b077daf8b84cead1f9e39

SHA1
a68cdddb32aa1cac225ee7a670d9abdb4e45f02c

SHA256
3a311ac89075cdae01f8e07e27e135e05f8d5877232012d68d881c305fb2b945

SHA512
4a2020bb0e3c0b91bc25fc25f1d0bf4bed673218f1c12dc6393d4e71ad7f89896623a89ca2ac0e0c608baa2034640de0f0fbe8321dc7c05733e1545e6d61ecd9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e2b5786f1ae42bc2d4c7b623d6d1224a

SHA1
02b955cf8ef9ee32113306478f7c6931bdfdd3d9

SHA256
b21448be35d884162dae0d303db10fddbc651839de8aac7627349a63f0a2261b

SHA512
2f988cf520b768069587f35086ae62b76b787c89f482c455389880f295b2691c7ec9a584ef6bd57e69984bd03ceb3e5772cb04203e6d04a9bf1cd8a4d7f6634d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
935c460f80b8bee8cee5350d2e4d4549

SHA1
ea29d334a4a09035afd5cb0d70b62e6cffe42c3c

SHA256
a707a8be0f18dcc5c434d90668ba2488f0d477f80bc8e1f8954c35fc9cb58c08

SHA512
52a8a0f76bd84cc45601848bf158386cc7f6dba6c0a33e510e4a795829f02619307651121ea3969c9cdefd5d82db44fb4dcafb721c77ab17a88c77434b19ef50

Download Submit