b7793533be93f6a9a60dc5b7946039c26ed21fa918af8dc606531c87cedb6cd8

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 16:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3af91cfb4a0326660306b3da5160ebee_JaffaCakes118.html
Size

175KB
MD5

3af91cfb4a0326660306b3da5160ebee
SHA1

ac2e56ce7512023c37528007efc7de0a81e201d8
SHA256

b7793533be93f6a9a60dc5b7946039c26ed21fa918af8dc606531c87cedb6cd8
SHA512

4f26115fa13d10bf80baa3b8ab064409c702d764c0ed7dc32b7249441a79f32bf37fadbd689ec01b694ef369c6be6da7c8718c1958123ce1ba1c4ff21d2a1da8
SSDEEP

1536:SqtO8gd8Wu8pI8Cd8hd8dQgbH//WoS3CGNkFHYfBCJiZ++aeTH+WK/Lf1/hpnVSV:SaCT3C/FWBCJi5B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4832	msedge.exe
4832	msedge.exe
4168	msedge.exe
4168	msedge.exe
2372	identity_helper.exe
2372	identity_helper.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe
4168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 5024	4168	msedge.exe	84
PID 4168 wrote to memory of 5024	4168	msedge.exe	84
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 1164	4168	msedge.exe	85
PID 4168 wrote to memory of 4832	4168	msedge.exe	86
PID 4168 wrote to memory of 4832	4168	msedge.exe	86
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87
PID 4168 wrote to memory of 1992	4168	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3af91cfb4a0326660306b3da5160ebee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbac2346f8,0x7ffbac234708,0x7ffbac234718
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2984 /prefetch:8
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4068 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5892 /prefetch:1
  2⤵
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:5428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2056,9403465654586728127,324782643088539941,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1824 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4648

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2420

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
ebc1c38f81bf6a1ff9631cad65103f48

SHA1
ea3d3d4ded258eeda2fe8f4d9673c60c919a84e3

SHA256
e7d2307f9837e61829a42d5cb245b6ed9438c16239a0e1ae659758ba7d453285

SHA512
d44c8d1ec9e94356a7e41ea1943d1324f8051762a13e93f1404a49fd70a550e660d372a1c43742a624cfb50f7ae227b1b0d6a568028a529750f2dff7c41b802d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
92fb044bd94cb1c1e27f8489d854950a

SHA1
70ffe753c0ff891a51a98bce4609529ddfdc45c7

SHA256
bb1a0aaf94673b46e2f95ba5e33f17c39b9c8d9b52350cce5b9d4fde3b0ed623

SHA512
549d91154ee1bfb707e6893bb6fec1d32c173dbc10fa9d6321da6472b63a7b59c0471e6ff26241efd27be94018722817ed32ff86265a8b54e0d392a353acab01

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4fc2b1bd3dcdce953eaabea26c166444

SHA1
4e2642588d7bca589deb524bd9cc7035a0698a8c

SHA256
4bb6308f158f818a0fd6d8b992afcc8310187f21df3adbdb86c59a40f3126bc3

SHA512
358ba130473c9354e8b773cc1dd7443120c552fc5a3855c150f6e0a1580933a1a623277ef941c522303814a8bfbe7200cd9efd78bfebef310cbb99d868e2fe9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e6df619bfc031e3ec8d921475932d97d

SHA1
fab8297e9d1ba829dcda8ce8890da66277154620

SHA256
34e0742c7379cd91bc8db2ada354223d0585b424ab516c94a4c0cb8446db91b2

SHA512
733717ddf506f7ad7d1e23052da25cc361e72a89220300b92cacded162b637629d664774d49bc60cfc9d4c09a709d91563176c17ed9a30a82c644c536d9c420e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2a4b4c614358f659c056dc339e5f7b85

SHA1
6cfdc0622197265f8fa1525f5857c5b929b37723

SHA256
9048c0632f7399c94bda8aeb90b7b0e1fae4f3d529aa1a7ff20cfd300b3d2064

SHA512
84f162c4566e2303e426c8141a61d60b30f70cbee726771e765795bdc36e0713b8c18ef98563e7fc12a3dd7eeca558386f6dae72a98a238fa8e917874ff7fcfb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5701f89ad78fc99dd2c2a94ea6d7738f

SHA1
fe35ef86e87dd1f54e9cfe5b1856c67d72687ba5

SHA256
8f9294da1d5d3237aa7f218046100c155919b9bea1355cd7f7bd6daa52b83b73

SHA512
26cc3997bd1a1d521b06f47fe2a1d2b05b7f4677c9dd46c5f47f7d2284ad259bc86c1f17c99c2b26142e3fc8e4d168e1e991b25814dc50a7a0623e80b34c1819

Download Submit