e186b1b430dce69361c72947cb6263debe2e36c5341160be7f569fe56a842599

Analysis

max time kernel
145s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 19:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

30c6f93e43abe19efa0f65a504a79e9f_JaffaCakes118.html
Size

31KB
MD5

30c6f93e43abe19efa0f65a504a79e9f
SHA1

dd2fab0d8458b5b3860b7e67118712ac0b962106
SHA256

e186b1b430dce69361c72947cb6263debe2e36c5341160be7f569fe56a842599
SHA512

d5e92ed85a8de90f1304f940aeeb2aed23ad86d108529ec38c1854ab8af10ec38ca0d9214834335c96f0879ecc6c0207195288e4e7fd17a9f5766feecd01b486
SSDEEP

768:ki/vm8MoT9KYK9WAIoiVLKJKZjKpP0KAWT/lQ:ki/O9A9KYK9WAIoiFKJKZjKpP0KAWT/u

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
544	msedge.exe
544	msedge.exe
3280	msedge.exe
3280	msedge.exe
4412	identity_helper.exe
4412	identity_helper.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe
3824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: 33	1904	AUDIODG.EXE
Token: SeIncBasePriorityPrivilege	1904	AUDIODG.EXE

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe
3280	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3280 wrote to memory of 3584	3280	msedge.exe	82
PID 3280 wrote to memory of 3584	3280	msedge.exe	82
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 1816	3280	msedge.exe	84
PID 3280 wrote to memory of 544	3280	msedge.exe	85
PID 3280 wrote to memory of 544	3280	msedge.exe	85
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86
PID 3280 wrote to memory of 2560	3280	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\30c6f93e43abe19efa0f65a504a79e9f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff824c446f8,0x7ff824c44708,0x7ff824c44718
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2164 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2860 /prefetch:8
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=3336 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5628 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,6129112142459683665,13806346138473310609,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3348 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x3c4 0x4c0
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
5deee268d8703425ee8359829044ed18

SHA1
58a1d44508b601191cedff04cd0687d0ab6ffa44

SHA256
974c6680c1a48fb5f766d7dbbb0c4ec25e4e4d03a8e906b78324c67bc9f50178

SHA512
0fe252ed72b0f1da71588c724fb541151415a75bcfe33284d14c6995f5360e64c7ca93ef5de264086ba6ad91fd7709a5fa9da772dec0432eb83d9c29a8e94ce0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
191B

MD5
c2272a6b22ed2901aa28a89dd552a814

SHA1
2c724c7d976a6fe127356f5a3b4c28e3c6646bc4

SHA256
d0baa977b838ea66986880bc91915ebe0931e0bd202fc43dbceb3966adce2d83

SHA512
01a12491a657ae4c730d56d6ac1db5062fabd8ca88d9e2bcf8e44460a9a16dd412a8a3e6ceb23cd88aaf5725046df4d2bbeb838cdc481ca87a0085313547b50a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
947B

MD5
44fdb6e3ebc19b8900e99e778849ad2d

SHA1
880293d113423c90a5d63094eb570f6a1ad28dca

SHA256
ceaff355a21220570b54b636dddec9416e0698e36a9eeeab5c43ed588f58e264

SHA512
cdd88bda60370ccad4b76c6259694020dc289f32304ffc9b7b7a0237c115bcacc98e2d0b564a3cfbb70e9ce692ed7f855f8bd8d9172d177f5bd1183b6919df50

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
03ff54a8230a3bb0ca5fa035223606a6

SHA1
faa2453b3b2acf12c88fb090a56e8bcef16584db

SHA256
5db365cffe9fec6fca343e7eea3899bafce3297ffd2e8718cd17a6ee17aa2fce

SHA512
cc6bcb4e54a9c4eba9baa1d7bfff06540111d25b503ccb8cf6d590a95d7b7824b8905de69f116d2dd2b8938ab7fe79b35f86c6477c7914df36c47b2334444ef2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9154c43d5f971ae4a735efea0bbc2ebc

SHA1
b86a6ff4529b90d5d269585f2a85b1831e96abd7

SHA256
e4d427a25a91afa92b0d101bd0968d8ce82beaf8cc0b8110bac69af1095ed71e

SHA512
205ee337a8def48a2c6e0ddfa2927970533ca14185bbbbb1589419ab033a623869af2f30302c17a4de116f9e589c4811a78c95852cf3488a0e06641816b3b967

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
73e0824f668f4a793b1adf02c6f6ff4a

SHA1
f5c225edd8a635664675afa820aa9b5a245a8502

SHA256
df41fd14abf5a6b5e17af55c30e3ccf461134f4cc7fdab339ad9ab19d7ea2bc3

SHA512
32191061173901f6fdfb4edd7adffec9d8a43d7880e15367887ab8d8fb0021aeff3d2db9918bf91a5e52e9c698bdfc70fafc8807bb6a84930c7a995384d52770

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
fef10f6e824efe95796f3db8fddcedf7

SHA1
b34e88649ca313d057efe5e471b40ba194205b98

SHA256
575d3888ff2892253a9b8575f12540e5b1153f582d24a5f1854bc24220576f98

SHA512
2d7efa95244f21721b5d476965b8d338aa33821c487ad36cba01e198f4e0fce088a948f0f058d9e3dba32717943cf15459e90301e96607e0ac27c74eca0d3f1a

Download Submit