b61ff8a60fd7d0f65b4f5b7d8e733e5b9d9412fedd596aa1f70afb01a2588287

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 06:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

1fcc3a228cda1f56a976c99df813c8fe_JaffaCakes118.html
Size

33KB
MD5

1fcc3a228cda1f56a976c99df813c8fe
SHA1

f614bf4bdd0e0bbdb680b6b5b81f396d55522659
SHA256

b61ff8a60fd7d0f65b4f5b7d8e733e5b9d9412fedd596aa1f70afb01a2588287
SHA512

3fa75e4cdf36c2bb4902b2a3ec4e1d0180fd8e58c79b5b64a9f2418927775b93c043807f89e0f062e4747a955739b1416646613da0d7fae7215d0818992b50c9
SSDEEP

768:XF/bc1bghmb2vbnGnST/G9bNylWLFeoGeX01JZ4JOYAX2VKo0P:XF/yEhmSLGnSTEZylWLFerJZZG07P

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3772	msedge.exe
3772	msedge.exe
4992	msedge.exe
4992	msedge.exe
1288	identity_helper.exe
1288	identity_helper.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe
2024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe
4992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4992 wrote to memory of 1516	4992	msedge.exe	83
PID 4992 wrote to memory of 1516	4992	msedge.exe	83
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3488	4992	msedge.exe	84
PID 4992 wrote to memory of 3772	4992	msedge.exe	85
PID 4992 wrote to memory of 3772	4992	msedge.exe	85
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86
PID 4992 wrote to memory of 1848	4992	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1fcc3a228cda1f56a976c99df813c8fe_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdba5d46f8,0x7ffdba5d4708,0x7ffdba5d4718
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5672 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5688 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,1750631223228507495,7211568037477493253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1936 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2024

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b2290ca03b4ca5fe52d82550c7e7d69

SHA1
20583a7851a906444204ce8ba4fa51153e6cd494

SHA256
f9ff4871fc5317299de907489d466e630be63d698c8f7cb77cc81faddbecc6d2

SHA512
704ec8122cc1c263dff67ddbb5c20ee0db8a438674d716bc3be5b266ee5629a219b0049d721f9eb2dd8f2d8fda0163659eaa4d3e1f0a6e9072a8ffb92bb2b25d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
919c29d42fb6034fee2f5de14d573c63

SHA1
24a2e1042347b3853344157239bde3ed699047a8

SHA256
17cd6de97a0c020cb4935739cfef4ec4e074e8d127ac4c531b6dc496580c8141

SHA512
bb7eadd087bbcec8b1b8a49b102b454333f2f9708d36b6ffc3c82fdc52e46873398d967238c3bfe9ac6caef45b017a5fe3938ebf5f3053e4ef9be7b2752b563d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\65c7320f-c79a-4eff-97bd-b4204d40bf2b.tmp

Filesize
5KB

MD5
2260ef2110c41f1be602a408a4df8710

SHA1
4ec9d0e3e798769c36914ffd7fd35e59899611a5

SHA256
8747febca8228b2bc493e7678c92d881ed63cd2ba3f2f98750cae8ac5087c721

SHA512
5698ffab335654e965e91eb9c4e3a21d843012db49344a7318befb488a7d98071935d9e887d4cf9cafbd6990b25cac6ba7c10e8ce66cb97438c910fc03822710

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
281f8511e0d90cab58e742da209d86b4

SHA1
99dadb5058a052a623a38aa339a47dfd9fa2730a

SHA256
75e8f40a195b0c6df992c046ba193f64fccde218ac71c0f6ebc94c95acf47126

SHA512
3e27707a613c5969b372c545cfaf65ef540e1e00ae0146c1bd50c3b03258bda7cc75274557eef2ce5bdec5c1d93d044a48b73f8a3a73bc71b5b494b47dc9d702

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
31daebf43c309a22ff1381951a5a49cc

SHA1
3ed7418b03b0ec8f2ed81db6d104a945359d5371

SHA256
e7cb0f5b021b2edab0ec092c4d5e5360a827f9365a607fd496e1f1b00fd2b1a9

SHA512
182bb26f25aa60b406a065648fba176089edb222cc475d0e2abd916b4cb29a441981bda95b6ae3df34182980fd8663300e9ec9a21bea0f48933e9eb1f1029378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
987B

MD5
21e401c450773eb4c8b29b0fc3813392

SHA1
08495afd49e6d5d74e26dbf8e5cc5401a6b99957

SHA256
98dda5dfccdec75aece73b0a8800d8b0bce640abacb1a5f82ff8db506bf9d4e4

SHA512
5c643f3a7e00b9d96692b8d20626d5404b3ecff4e327d80fd381b5112dedc12a6e522b8140b67b049442e433f730966fade7113ea32c74d6023155c14f28bea3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9db6093a58bd32b84ed368de9979d1ca

SHA1
c99a66539abab917c295203450cdb60cfcce53d1

SHA256
f3ee642e065b91c2a2a35c834cf5d44d98e873e9e226b6cfedea13785e64923c

SHA512
95e4e48abc007e05c9004a8d6a79ef8950a484f7efd3c592885a91a05ac59e30566cc529e7536de49be9d394fdc4614b97840b35521d5625ba379470ab01f6e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3ff07596de14e47fcd8b7c9a38607d10

SHA1
d50f8aae6cb17f0a6165a9d46a14d72f64a0c018

SHA256
201b434e73f8ff8787bfc1132194555845a37a53006922473d151dafa21b3354

SHA512
281843ecfcd9005fd81314e10974ef9946d559baacba1f7c59b20f069c5c27d62016b9b1a03fe3140a98dc1fd9bacc99fcbb68bcb8ff24276ad4bec555ac6e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3e4e944e7fd3cca33b0a4a5817ba8675

SHA1
4c040e5619a6cbb4ec0f7b829f34e1257a97f515

SHA256
b342058095284b4edbe4dc273ae7210ef39bb10ccadbcc0ff6ae73167bcaa6d1

SHA512
ce03f5f27872f43190e5cef816e5621e3673984f8d26880447926399ea8689c3c9c3b0429e8bf1bf826180b0592ebc3a7dba10a3beca946baf7c4e5918aacc66

Download Submit