b963365f566087b084bf2f4df9c79359f9c196855bcc9c52605814ef6e30fd32

Analysis

max time kernel
149s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15-05-2024 07:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

452ccb324b9cd4731a777864e5d789b7_JaffaCakes118.html
Size

175KB
MD5

452ccb324b9cd4731a777864e5d789b7
SHA1

7f3d03cc687f012be6bc3d8704ecca2aa72e8000
SHA256

b963365f566087b084bf2f4df9c79359f9c196855bcc9c52605814ef6e30fd32
SHA512

d92481c86045e300e21a83f49f4b1eee13fbbf933529f77942726061e546020ee8e9a2758d5aaab4971cc26092177841cca3ce82278428b3895afc8a2fde9626
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3pGNkFNYfBCJiZn+aeTH+WK/Lf1/hpnVSV:SHCT3p/FIBCJiaB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3956	msedge.exe
3956	msedge.exe
1852	msedge.exe
1852	msedge.exe
676	identity_helper.exe
676	identity_helper.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe
4724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe
1852	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1852 wrote to memory of 3548	1852	msedge.exe	82
PID 1852 wrote to memory of 3548	1852	msedge.exe	82
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 1664	1852	msedge.exe	83
PID 1852 wrote to memory of 3956	1852	msedge.exe	84
PID 1852 wrote to memory of 3956	1852	msedge.exe	84
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85
PID 1852 wrote to memory of 3656	1852	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\452ccb324b9cd4731a777864e5d789b7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe69fb46f8,0x7ffe69fb4708,0x7ffe69fb4718
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4732 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4792 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2204,12039617149923262940,4585002945442863785,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3352 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4268

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
1c73f10ce62e35b50992a60028fbf934

SHA1
9644d479295e0f55d72b9ff1618bdf57b2f21af7

SHA256
60201970b82fbc2be0817cbf6e495e50072881a86ae5dba2f5e8e38175451c7b

SHA512
1e45c4d2b9c0e3e024b8eb93f348e2ca0a217c452e7b18902ce53fa190965076ad3ea414cb02361c84356e9781a215f65450bab001273dbd0235b3b9eb41a440

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ac1a8963f82d2fcf1a0562fd65231bc7

SHA1
60ee8772d3ca1da037e97176e55082b5a95eb695

SHA256
78e1151e92cb5bb721577fdba83ccd8bfb9a6d9ddcb465668f59cdb323ea79ae

SHA512
8c5ac54e8bee50cea556b86057705073be0cdd2d4ab9a099e1fbe7a21b4a42cdde4223060c794fdffa9cdd9aaddfbcd9f9634e2f235b9a1b0c7e04be8bcdd65c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4c69f71cb45261099d22c554985c45db

SHA1
cc7fda0e101cab4e79dc539efcf2be6b28c6bc7d

SHA256
6dccbb4fc633a8bb98997dcc21ed6c26a52355a8da949f9cdd06bd2da1077a21

SHA512
9fefbc24b2508ffa1d858cd9ae6e3719f0f4980c0b7aaefe372113af207d6c1ae632f48bed0a7bb58a54e7a1dc0c88d36ce8370ee42135aaa11929c4f40c8634

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
932189d64f555cbd9fa3935867ef2963

SHA1
3fcaca69abbebfb9300d718529b5c546aa338984

SHA256
d6dc92ea90b46ea70323d30abccd56ff1d37e5ba403ef12fff1072ded786134d

SHA512
e0fe6f24318b5b47e672e9ae3d4721c26386d1e6a4e608a3d2da635faad95d31d6ed679893512821b2834604b2f0ba27c982310b5e2f5543baba6761607ac10c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f1be6c3cc6cbc3172abc69ddd806e99d

SHA1
3e73d7d1c03d0612fd27b254a51933544c18a98d

SHA256
3601a085df702a9e57cb4059e441b41ad124cfa94886270cde7d4823c5a18444

SHA512
4d12710b1fea885ce93c6abcf04165e1030f737d86fff2459162f0660c8fa2dd565ef4d719e5df89964ce85a92b280c94625f43a85ccfa375d1f6fa9b86cb4db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4b790c5c3e9f2afb97a3a04c60510343

SHA1
8494e7e0bc7672d59cf1558e5e126615e65deba8

SHA256
51f58e5d8760b3de97c6a8fb4d225c1ce9039d5fbc32e02e80a3e59c04550426

SHA512
dab26bbc13402802a090ca0a0963acebb44cc3b9ee226e5db7b2a3aeda75708c93020d60a5d7bceb74d21a37cda59ff67c547e66c3b1efa28caf7c6e232a2158

Download Submit