ac36fa2f242728cd84077bd40cbe65ef7dfbaf89cf696b0a641d1e0c0e0b154a

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 18:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b6cfaedf6889cd8b051bb3618bf7bf7_JaffaCakes118.html
Size

175KB
MD5

3b6cfaedf6889cd8b051bb3618bf7bf7
SHA1

72c9f458fa5bf1e3feb7889f3976c8acace8dd97
SHA256

ac36fa2f242728cd84077bd40cbe65ef7dfbaf89cf696b0a641d1e0c0e0b154a
SHA512

fe4af6f8123836603bc5d68b2b0e114829f78a5198b3450b0af2383104d6c26d7fa921b8e3a2072a588424209e7d5a62e6a03271eba94bf54860445e86acd6d7
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3KGNkFjYfBCJisw+aeTH+WK/Lf1/hmnVSV:SOoT3K/F6BCJiSm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1776	msedge.exe
1776	msedge.exe
3564	identity_helper.exe
3564	identity_helper.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe
4468	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 2732	1492	msedge.exe	83
PID 1492 wrote to memory of 2732	1492	msedge.exe	83
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 3036	1492	msedge.exe	87
PID 1492 wrote to memory of 1776	1492	msedge.exe	88
PID 1492 wrote to memory of 1776	1492	msedge.exe	88
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89
PID 1492 wrote to memory of 60	1492	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b6cfaedf6889cd8b051bb3618bf7bf7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0ddf46f8,0x7ffc0ddf4708,0x7ffc0ddf4718
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4768 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,14927641798992399895,4940526593823873607,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2036 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4468

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
65dd9c73f4de5ff2cd8c055802f8d48a

SHA1
af1371925a16a8931eac3ced04b328d431ef8bff

SHA256
8d34279e043e45d2757903b5c9572d0b0092864ac9038d2503013c0fba540690

SHA512
3d0a9d8e9662844614ed67117f4148ccadb55330f93eca2c384f23da23fb2613d6ebbb67933e77e4452a65fc7853a37cfe488d72484379f839de6794c83e360e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
418f15fb02b528089dcd47817e5d2459

SHA1
7d41e026f35102b38ff5a92a23d195bd6e148efe

SHA256
e8787b885fc42d202444b0855216ce11aee25ac27fe5c173e2b16bd6250761a3

SHA512
6c71d9bba3aa67396a09cfb025219277574304bb1fae13607da46c6ca32c399f90c370cd3bf032636c68821b748621a88d0fc1e598d7a580a5b1fa7deb46b079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c410140f056ebb6498543da9f7b9040f

SHA1
f576bcf5fbb61145ff370055339580a1e342b4a9

SHA256
44dc42a9c5fc495c81a38ac0bf35854fccbbf1ae1b42b9ae56699abdd14ef35c

SHA512
4be3f69b010c6311dc5b3bdf3cf3d4b2b7d76546b26b6508c9de570b2b28258d4338272371306d0a82ebad62b00dcaaf364198f2723e0911943e6b533bfba19d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
021180621900aa28dd7f500d98f390ab

SHA1
359d310ba361d13ed276750f0f75ec3fa05b7f4c

SHA256
b5d56641cbbb3c42474b14320d2f6ca848f8ebe7d74b8e0984f1aa76cafd994d

SHA512
11dc6a169a1a4c72348746d258eb39a0a3531e1f75459205d67f0af31199c1013f575866aa25f12073918d53cd0b984c9decfd99c86a6e2608f799d43e313d6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9435ddc6e473ef1d47d8870c889e0969

SHA1
e53779c84b32aa65cd6cc170e0c0a4213dbd6af8

SHA256
5662b8dfe6c4deaea05e8dd5cf7583c4661ed34bd3167fa1242399f479ebb4fd

SHA512
020546e649858801b585f1f6ec2f8bb4cec2fb5e1b10e283359df3a216942cde687e8eeb7c1ea0ff849bc9099377f706db2fa3d021d3cd25ec04d988a2e1c34e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e59b5e632245da5a4ebe3d430da57f9d

SHA1
fb5de684677bbcefff9bacda6f3b5cbd03692f40

SHA256
8c2a0242f0b0f40f94203e82fb245f608e99461b87bcd854c108071c7da15c05

SHA512
2122b26c76f4a968b85a4b74c2f3b2cdd740b1eb9fc772820f7fb2ade23517825fb365d5e4b9b48f38bb99ad651694151250f45fe8e866b46875df64b39d799a

Download Submit