10babc1c2aa4034d0640e6a11fc93eabcd1c58e1db9bed1185b515b8918baac8

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
08-05-2024 13:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

24fa02f3a197afc5610608f62c7eb2fc_JaffaCakes118.html
Size

34KB
MD5

24fa02f3a197afc5610608f62c7eb2fc
SHA1

863b99c4399db87991e363ce5e44b82283aed403
SHA256

10babc1c2aa4034d0640e6a11fc93eabcd1c58e1db9bed1185b515b8918baac8
SHA512

ce220e0c7b8323a251aceb3a55132f88bf60cbbec8f0cf2f894015ced39c81f6ffbff389e2d10896d55281c3c3e617c669d20b2fcaa8568eb82b929a848af860
SSDEEP

768:Fi/vm8MoT9KYK9WA6Z5pR/KJKZjKpP0KAWT/Ru:Fi/O9A9KYK9WA6ZlKJKZjKpP0KAWT/8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3552	msedge.exe
3552	msedge.exe
408	msedge.exe
408	msedge.exe
2944	identity_helper.exe
2944	identity_helper.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe
952	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	3952	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	3952	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 404	408	msedge.exe	78
PID 408 wrote to memory of 404	408	msedge.exe	78
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 4588	408	msedge.exe	79
PID 408 wrote to memory of 3552	408	msedge.exe	80
PID 408 wrote to memory of 3552	408	msedge.exe	80
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81
PID 408 wrote to memory of 4056	408	msedge.exe	81

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\24fa02f3a197afc5610608f62c7eb2fc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffcdb8546f8,0x7ffcdb854708,0x7ffcdb854718
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2056 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4876 /prefetch:1
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3548 /prefetch:8
  2⤵
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3524 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,12645157946347846362,165999029884787069,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:952

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3020

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x2fc 0x308
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3952

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
301a10f9da2da2f6462f444e45c11cba

SHA1
7cd376ea906e4bdbb697becce5455fe1f07f82ce

SHA256
f41fbf5c66e5823a5f5c31bc279e64c3017f411b87cbe5b4bd340510a05cbc94

SHA512
87d631ee24862355d2564b8ecda3866a4625b3e91d89f9dd9eb92f99d6f87bad651d31c39c77d48bfdeb94985e5f38ea77e94cac0abd88d7c7bad0fd10e538e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c9463079aa56fdda86a57efa3c672a88

SHA1
6ece50b2c935d8ccc71cc68fb23796d37f50c675

SHA256
cae5c24c5dc4c3f2b2705bf362d0f5f169ab6a0884f512461cc0747ff6580356

SHA512
e7d0001f81393d163587e1ef7e09ea183dedc1f594a1789e712a2abc2bfdd22973cdf381d003a8f0abc4785f2efdebd7edebb69a789a02a35f0cd6e56d499a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b5759a5cf2a6232c7c5a6f6e5ca92cb

SHA1
35d1cc7f406548066ca426747c131f657492b419

SHA256
6d513143e5dd1fbb764c53dc178f998f693da2d778792a66bbbfb385305a462b

SHA512
0ec1f86313c8eccc654a29d0a4556bf55d4550bdaa37983b07929b2b97d6d03d15335d41189f33f86c09678e687334fd229549e3ee561ce239b2d2b5852c5fd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f3f63224ff12f295ca15c2a5002f39f2

SHA1
77cad7a182851e7639b23ed3d869647f45591116

SHA256
ea5fd260fee8a0e8409fdd385ec4b2a3768f5847bf13c99a3e8c21d041cb0c42

SHA512
53d3b42235896e05811ab9e3ed5258f992d25c95d46e1c1659d14acfc2794e5b1f7ca2c0ff38611f457a93556c6c46dc9e6b6f9985a735bcaa155713c420cfb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1b5abc69b69ff36f2c61a8be7e5852ac

SHA1
fda7797052cbcd7b215eb382d0f9508da9495903

SHA256
b26ec8acdf3f2a27c8977dd63a208f846cdcc9a2c1dfaa3c8d774d5d82cb3844

SHA512
e0fc53e254b7ea4036835459661fea48164e4e4372aa60eba62c89bb4d13d261f6ce62132080c5c863458fdebf602fce91b248766d153483a32c93ff6c38c16b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
707B

MD5
673503bcfaaa44a96321b0a9dcd61bd3

SHA1
f6c387fba5241cb2bd6219ea6af0fef267ab22f7

SHA256
a387444225ef5ef1ee0a3b497619f851833405df8e8a01146e7d00f1b79d00c0

SHA512
56a67dce2c4377ffc67a20cb9a4d9c2a5b3823da2d603cb87e296ccccf3e3e6125a8b328f698537bf253eb14d27b283b939061862c3a1d12b8a2895800fce17a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586c13.TMP

Filesize
204B

MD5
9209c81507dfec750814a8e2793b1070

SHA1
fdd29ea6e763b2f66ccb0cbdfec4de54cc6aed1f

SHA256
c55736d6a07cdca69d1654705c3df11632a48d846af1404ad3b17195a8397568

SHA512
fc788d1ecfae93dfb7931239ab7da8382973a62f2b85eb0368e734d6de463c2cacba0ff690d0ef40623ff6c980f0fe768d66d2fba0e8f7191aea8534f33025f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
988d6cef1a0bf28c63d74864238cd63a

SHA1
6687b7a23357ee9d31ec4702a0c407752fd19d08

SHA256
f9632621b5b160606163649c51daac28852c6157c650f7f29459b4a4ad97fe24

SHA512
431fa70e2fdd22a99420a55c8dc8faabc93b44f5c62251b5fb69de7a86d9646126b01daec30c926d3c5efa3695211e00831bdafc5a23e0bf85195a0c66d43ca1

Download Submit