a13390ae8bfb2ef886113ec34447546b3a0f37ee78503b2c266faae7fe77d9ab

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 04:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0fb34e8cb71fb8e37163ea11d173370d_JaffaCakes118.html
Size

53KB
MD5

0fb34e8cb71fb8e37163ea11d173370d
SHA1

d650c1cd2578e4a0897fe19c9fa9afe05e102853
SHA256

a13390ae8bfb2ef886113ec34447546b3a0f37ee78503b2c266faae7fe77d9ab
SHA512

bacb61e213b299cf69a18dfdb799ccce17b03b81ffeafce3fc715be7a5ccb4e40569b36adf03add1e7c9436df5128d428a06ff9cb590b4e0ef21d55ec766d35a
SSDEEP

768:lyKhC49gpL+3JBSjfQPtiHrT76hWr/r/BaMkvww26rhUgXE64+To6eJhcR:lyKs+gpLcSjoPmDZaMkvww26rkOkQ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1732	msedge.exe
1732	msedge.exe
4880	msedge.exe
4880	msedge.exe
3312	identity_helper.exe
3312	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe
4880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 2564	4880	msedge.exe	82
PID 4880 wrote to memory of 2564	4880	msedge.exe	82
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 4864	4880	msedge.exe	83
PID 4880 wrote to memory of 1732	4880	msedge.exe	84
PID 4880 wrote to memory of 1732	4880	msedge.exe	84
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85
PID 4880 wrote to memory of 3744	4880	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0fb34e8cb71fb8e37163ea11d173370d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbaa2846f8,0x7ffbaa284708,0x7ffbaa284718
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1388 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5896 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,3422304226467391177,14430594996169865799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6004 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
683cbc5cfd69a6866f61688049caf6e9

SHA1
cbab7a32057fc7901e4ce56852efb08e17a83ece

SHA256
03f742e517c1cd322f7dc239238eacb571f37c2413715343ec4b57ef03856f60

SHA512
04837d8027c70beea9aa76310926bbb8a316ad44986c315ebfc59582eaa032641bcf97985b4873da63ca516c28bdd3ca6ecb91cce2eb6dd28370a2048fbb72cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3080644e26901d20b75871aebf8aaa03

SHA1
ec3c10b7979c33187378b33f4c97592471cc3868

SHA256
1591cada56910448da703cfae507a926f233eaa9c2a96e6b9558a287a86ffe38

SHA512
56101cc68edf6eaab322cabe7d3c7c1ec6d47089c977eabf492a7bbda103f6361dc3fc930edd7dd2043c73cdd7a0a02e8064fe3f00d9f4a7ba8e6d31f4b6d540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d7c6e4f23cbd82d4cdab1763c669a54e

SHA1
3c13a04ee9bb7f03c132771ffb9ce1462e82c591

SHA256
0e0f91092bb89aac2de7d1f1df64f682d49dc1a3da281be7984551a28fff4607

SHA512
1394fa9d3b16880e6dbfa6e36b6e562e2a91035b21b0d8a282bb7eabb118da0002735a9c567e32002b80ad249ccb739f05a6da3e42e201552a9ee53d2fe8c559

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca80afcfdef3599bcfbbb61ec795f0dd

SHA1
12534c6b3a8cdc184a981fcedf0a0a6da3e4955e

SHA256
05faf65e3104f9a730aff75bee5d5c43c96351945b82007eff6aae2edf2ad27a

SHA512
1abacd3cb7cda33a9f0ec98ecb4834c8dd56338dd7a5d556acaacd0fb5cb445fba6fedaab62f9ebe42958142b4148a0622759faff55dd708a2783ffcab5b0d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
53de4b0e974d474b59b373b7a6733fcd

SHA1
bc6b64a7211a55c34479d8ebbf0288ea424526aa

SHA256
6e76dfb90f74f4182c4558ef1960c49e96f60f4c5013b0c195e758d6cd613699

SHA512
4db626ff6a73bdd65c4e6684e2ab59420afa7b9866d7fe5a0fccfc36bc9d47e722b636fb5a186451ab978de726ad27ea218a8d1b9c793a5ef1790dae66ceae93

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
4fb075acaeb7efaefcbf2b010c66bbea

SHA1
49189ba2b8626cb4871a4ce46f574856231011c2

SHA256
15a1b7689c21042fe0723ae7d2a58fff89922820a095ce80142737295b826893

SHA512
7b76fbcad78a36d3bb8dced645276890b1ef07da5dbcd53ebd3f0ca4e7d0dda2d7b978c6b5620490f989e31fd348e013bded60358b2c1d032c0e5416c6883f21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57cfe3.TMP

Filesize
203B

MD5
53554ec2fbbc28e80ad0331bac0cb9c2

SHA1
222bc0b39b830b9cffc7d571825b48a7ed2c50d0

SHA256
d3156ce7da246114f9287bfa5638d5009a072374fe15097cb59558ee2189a26e

SHA512
4fc7606aa8ecdb751e03619607acdb3225c44d0c06eb4bade90ac17e729438be7118bed19ed629b9e67302f6c275c5d08b948d316fe7310a261dba4ad953be2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
6eaae7d8f500c5dd0fdbda98bec5781b

SHA1
91f502dc9248defb98512102eceed221d1e82e03

SHA256
e46e3f73b92ad2c2dd25171babb949298abd87a8d91fa2b2fe0458587802d151

SHA512
cb9d8c746d488555a02ce9c98cb5e428e3b82d4b63dbb0741c251abe477302487a34f0323f860a491c05e0d9acf28f14386701791a67781a368edb98c6df0757

Download Submit