ecc77a6013eb79f2e582c03a93b535930bd0415aca648b21406e888c92244f49

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 22:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b90b423dd5a94272e4723a53019828_JaffaCakes118.html
Size

893B
MD5

f6b90b423dd5a94272e4723a53019828
SHA1

ba1ee0f16ee8001925149126ac6dfe7d6be30aa0
SHA256

ecc77a6013eb79f2e582c03a93b535930bd0415aca648b21406e888c92244f49
SHA512

76910269cf2fe76baa8df0e805cfbd06ae8ac5bd00df91412b1d3e500d9c02e26f1f938f96f36f49d9bb4faf79c3105f8c4773ede075c6ac559f8a63d7757e38

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1512	msedge.exe
1512	msedge.exe
1716	msedge.exe
1716	msedge.exe
1856	identity_helper.exe
1856	identity_helper.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe
3336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe
1716	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2156	1716	msedge.exe	85
PID 1716 wrote to memory of 2156	1716	msedge.exe	85
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 2060	1716	msedge.exe	86
PID 1716 wrote to memory of 1512	1716	msedge.exe	87
PID 1716 wrote to memory of 1512	1716	msedge.exe	87
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88
PID 1716 wrote to memory of 3408	1716	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6b90b423dd5a94272e4723a53019828_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc824f46f8,0x7ffc824f4708,0x7ffc824f4718
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2524 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,425242956270734788,3590863954360149052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5272 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3336

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
5e2f0fe48e7ee1aad1c24db5c01c354a

SHA1
5bfeb862e107dd290d87385dc9369bd7a1006b36

SHA256
f13b3ebe8d71bd0086d5bb82364c35f59a95d32b39753af251e8639360e291a9

SHA512
140d026437fd5e8a874cd00b03950c8f010e1a0732a0a1cc5bdde477e7f8315ccb95790bb4c15b8dbaab9468ad532eb885b6c429300a64e39412d976d079324e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7e0880992c640aca08737893588a0010

SHA1
6ceec5cb125a52751de8aeda4bab7112f68ae0fe

SHA256
8649a39877c190ec740a5422284ec5f9ff509b30b2d7896635476873dd8824e2

SHA512
52bd0a38ca7f43b26731966035045b1cbd8b60b2d81bdf9aad791cf444da8af8b722ebf3cb364a6e660bebdf23084eb0e30bc23562575b704801669817549f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3808eeaf-ebbb-4593-8d3f-21ba69e9973d.tmp

Filesize
6KB

MD5
60b817006f6ec551ca7e9574be285e93

SHA1
5f60081a8133d9d1988a1b0c4544bba79d5081fd

SHA256
52671116deb7e0d691154a7c99c847d56a0d39dbb1e466a4def8573c353ad499

SHA512
954ba67aaa528c635467763434de2c92efffca4b9d9de81eab559ccdd1101d0c2519a31005407db7b95c214ce969b66cff38fdcf481a2cb9be4757da78386868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
360B

MD5
6e1943f5a783b2412c667b828592af5c

SHA1
983becf61c44577a68cbc6f75993f411a46884d7

SHA256
934af73b3ef7ca400e625fbd37cdbe89439c25a5fd7349c206a82b99f3d61969

SHA512
e397286603cce28ee158163246d9a788ba47c4fe340e5825f9b4b0fd7154f77663f6235bbe5e8adf18a4e1a576260186b4e29b4223c6a7f82e801fbc74351175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e614f4d124cfab28b41f4c12b230399

SHA1
92cde13c5ecdc160d5b9a5777880f15e565c16e1

SHA256
abf2dec5ee92709ef7f98b9221aa49e418266e75e1091096dfc83b1c49bef256

SHA512
6b0d1e60e71a6723223e449588eb38dfbaafdf1e8276d311d23c7c6affd6c68a678de1cbd013e573686e886209bc94802c0d561a2317de96f53462f97d791b56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
282b1eb32efcfcffdb83f6f5bbd4ffbe

SHA1
c50373bbf29d474695e1e1b13670b0ef6af344be

SHA256
efab282fb69f481754bcc5ffc3a2a51ccc9b3469832b831f915d7c720fdb82e7

SHA512
ab9146f1a5c88327d1a90db1a1a6f11971fde6205a66f510ea959aa9c73cd3b4a33e2a14344fe89afbc8a953f170f9bc4decd061f8785e4b124725d34366dc05

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe57a2c8.TMP

Filesize
48B

MD5
5768b1443fabd289bb419efbe7f8af60

SHA1
37d014db515720569ddf994b220fc4bcd9ef4729

SHA256
e1d1b19f881dc3780cf8b17705f8d95259b7a3983fae1857160de9560cf7face

SHA512
ada7b557d219cb47ce7f7f1b58ec1364c16267b915827b67734f3a0241fedcccfee534d205a1263c869fa2f0c88ca1b1bda1ad19ad26f0d01f5cd81c3a2270a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3b9d6eb34a88b400816b5b04de4cd35a

SHA1
6ac95f59b32e0bab3e344367b271af24f3a59e81

SHA256
f082756943b87b5237900fcb77770331f9b788359076af01587df33e34cbde31

SHA512
89b4570317bc946cac151ea1afbe8305f824c86d8d027e234dd88bb23e0c9560315c31a4661cacd6249b15ff754cdef2242c79e4719fdfe97eb258a6dd96d330

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7bfcea0b390ecfd4e63afca744ac5bed

SHA1
673404ba4e455b885e0c952e52df63296b04c307

SHA256
10f251d19f08c6abf9f4926b30acedfc023610c09ef8c1e78ef2609c9a364264

SHA512
8dbd0861c06676c98abbc09fbdeee938dd2c9f1893c07fcbb2cf1533aaae054959324c26acf3e0d7d761c21716db4308d3e6b1c0ad3583905be766484d94413b

Download Submit