9c4a2390110ac1683675676d50318b845ed0f69699d63fe8e005f9db2d8b0ce8

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 00:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

227d2573101a516aa3a9ca2a74acb057_JaffaCakes118.html
Size

58KB
MD5

227d2573101a516aa3a9ca2a74acb057
SHA1

45dceb397f62d2b584dacba86bb07d490d508c59
SHA256

9c4a2390110ac1683675676d50318b845ed0f69699d63fe8e005f9db2d8b0ce8
SHA512

7d31244a437e65568eb5a4f4dd9c1828b2d00729a2d9dd8e443826b64135757a3c5f8077304a3c2f0a16336955fec89399d6fff0b31678a0d664e5619041efdd
SSDEEP

1536:6GRRT9rCX7CeHAKsPbQJ1CPMeBrVjTRvRb8vFtenCNW6U02zArQJt:vRx9rCX7CeTsPbQJMPMQRZMFtEpJara

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4072	msedge.exe
4072	msedge.exe
5000	msedge.exe
5000	msedge.exe
4812	identity_helper.exe
4812	identity_helper.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe
1752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 8	5000	msedge.exe	83
PID 5000 wrote to memory of 8	5000	msedge.exe	83
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 1264	5000	msedge.exe	84
PID 5000 wrote to memory of 4072	5000	msedge.exe	85
PID 5000 wrote to memory of 4072	5000	msedge.exe	85
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86
PID 5000 wrote to memory of 4712	5000	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\227d2573101a516aa3a9ca2a74acb057_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2346f8,0x7ffa5c234708,0x7ffa5c234718
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2888 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,1251620054436741165,7333325216121969019,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6048 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4e96ed67859d0bafd47d805a71041f49

SHA1
7806c54ae29a6c8d01dcbc78e5525ddde321b16b

SHA256
bd13ddab4dc4bbf01ed50341953c9638f6d71faf92bc79fbfe93687432c2292d

SHA512
432201c3119779d91d13da55a26d4ff4ce4a9529e00b44ec1738029f92610d4e6e25c05694adf949c3e9c70fbbbbea723f63c29287906729f5e88a046a2edcb7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1cbd0e9a14155b7f5d4f542d09a83153

SHA1
27a442a921921d69743a8e4b76ff0b66016c4b76

SHA256
243d05d6af19bfe3e06b1f7507342ead88f9d87b84e239ad1d144e9e454b548c

SHA512
17e5217d5bf67571afb0e7ef30ac21c11ea6553f89457548d96ee4461011f641a7872a37257239fa5f25702f027afb85d5bd9faf2f2f183992b8879407e56a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
9758efed9fd31ec65d1ee1fb3e2e3df8

SHA1
3bc224bef7b12b95b33df090d77698dcf05235e4

SHA256
927807df15e0e43838dcd3ca7a50de4d631aff7caa3bddbf2306bf58a03a4c26

SHA512
1b328cf3915014258e495d224c786741ed67ed12057f330cc92da0862b8063df219a256da470fb60a3a4633d23061a72374e13eec91ac1af4480c927e742c70a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
7ac8fb4905262cc6dc19fa95ad9d02b1

SHA1
1f65ff9a7e38e64099949a5aaef730e86a1fcd7e

SHA256
3225322d5341781231a5352484a11a235a6e4fd61f58130a4dee723f5d9009e4

SHA512
50f4eb8bfa8da2fe11e3a1331b24aadad0c4be98b8ddc03e8855d82ec65554bb68965c98663fd20c0e16b915d5de727b0f18a1d2250f278f7891cf488546bb02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7c3ffdf6ac7d60d4beeb9964c5f55f8e

SHA1
4ddb2b59a2b06201c76cac05e3e158ca315ed00f

SHA256
1a84d9e4f1f48686e38accae0f5430a16f6e8d52c1dd1903e675683d3e9caf5e

SHA512
6d55df81f44533f68df40b1dfd496461ed0b46db115b9d62e56bd54c28070c2641c08968cef98e48d8e3d33c4dc8f7f77f4d88498901b634df45a30757d24da2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
756ed849b2ea7d4b9c707e99aa2fa8a1

SHA1
5f7ef2dfe485639b9a838b54555b52a344325bdb

SHA256
9b06c20981c3a7f731e3a04d0dcdbb73acc632f54caa33bec74c1f6e2ebbf589

SHA512
e611ef36183db6ddc89068d1ea40f12f80bcd43a5ba2a316d1f2a387dbd14c70d017b492e43a7e13fabcd2c19731128588bce67731d2cf9706c70b160bb21c41

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69d11a383b9c4257fd768e9c4880108d

SHA1
96aaf66033f6be75edf88595b7526a6215437208

SHA256
756ea62a7363cb00fdcbd93facf57aed0ec2a0675e5572dac2af5328327fcd58

SHA512
da5f0c5ab35787a350ea7e94be07edfc7efbda805a230e3869fb80dc8c1c78df27d63c89038350b56a862736d93e525c1368d33736661f45c99ac0cf4dad1abf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3aeb2b7cc5b76f84240a419a5547323e

SHA1
42b5a5bea2fbb9f809bd5bc1cb5a656ea85be8b5

SHA256
cb1e6e2dcc6dbbb7b25dbd0be6bab814d200892309c25ae3da61f8d121167615

SHA512
afd7cabf9ee60305e0de4459319e4dea1724a807a39c281dde0946df8ae40395dea23e91eb1011d3d09b262261fb594dc50c13253e6a2c19426b98b803101940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
982af48b20132f21c308e971525f9813

SHA1
1bc4bed32ac015eac8928689dfaec308c5436fb0

SHA256
2aa60cc51e60089933a732ad7c8b3e5789d76c651aef41bce9d165932350d2de

SHA512
62cc7d724e178cdecae281dee127b016460f194897ee06e2c93e6a15f72b0531e09512f1026f8cf84e98a294d2e6e942440612244ff13c9f49072061c4495652

Download Submit