9f3fa81cc87df4d8c7655ef9843cb81964f4322d64b025b59e1272cfc2faca17

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 09:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4a770cc6bb32f0626c9f3a4968e623fb_JaffaCakes118.html
Size

35KB
MD5

4a770cc6bb32f0626c9f3a4968e623fb
SHA1

90e4b32610841e29e3693a4bb06c83bf0eb654b0
SHA256

9f3fa81cc87df4d8c7655ef9843cb81964f4322d64b025b59e1272cfc2faca17
SHA512

c3ddc63d2030f3a04f33770dbc4df595976f105e69f15fc5229ab01d6bc917ab914d444112279c0fcabacb02b2063471c55293f32345305c11cb202401092f74
SSDEEP

192:ut31yeRnAu0PvNpqNtNUNeBKU8EmxjZ8SBbyDZHk6sU5X1+QUFWBnb35bsbUmbJK:ut31yeItEAjU5lntNTHufaREHZluus

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2384	msedge.exe
2384	msedge.exe
2680	msedge.exe
2680	msedge.exe
1552	identity_helper.exe
1552	identity_helper.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 1404	2680	msedge.exe	83
PID 2680 wrote to memory of 1404	2680	msedge.exe	83
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 1280	2680	msedge.exe	84
PID 2680 wrote to memory of 2384	2680	msedge.exe	85
PID 2680 wrote to memory of 2384	2680	msedge.exe	85
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86
PID 2680 wrote to memory of 4420	2680	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4a770cc6bb32f0626c9f3a4968e623fb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffad7f046f8,0x7ffad7f04708,0x7ffad7f04718
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2324
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3246133464334221131,854525445885661752,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5072 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1936

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1504

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
544abb8a1d8deeda5517a0fa0fcfffb2

SHA1
4084712e74bafbefb1b94376929b0043728a9dee

SHA256
1a23a2dda0526e77856386380afc4380569886a29ddd0dea19855e412729f87c

SHA512
b7ea9e7803cd72d050d37b93d8ab40e1c7b417074883f8513fc0620591119d013d002738b58b609cd60c44ec4e10fa1ee2f31b9b6998818603e7e05c3a5e8df8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
50c4ce210bd95507c015f8f386fee9cd

SHA1
6f188dffa28d7b7e7ac910030d6ad85544c56acb

SHA256
a31eb382e334d72befc85de991bc1049cd4d67d20be3fcd2d928212fcbdb18ac

SHA512
736bb971a8bcdf608a1dd489ace1b658cf24db0f2987a4dfbb95a79fd0e269aa33e85803c9c6f820baf6399c268e512b3ac38f66d7d992e63f15ba6622772d78

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
727B

MD5
5a46bdc5d7d88b0e37cf76f9abaea726

SHA1
0f5d7e9928b6e0abfce8ec583bb43a36919f8e5a

SHA256
c8974ceb197cf6e2ee9a02dbedb7dd86a689cfd64136f519dec69d931930e7c1

SHA512
ce714dc0882333c9429527e59208aab34fe40ca00ddb2481674fd3c747a26de2216719b3277b8cdf2203ee2d3943de4c15e2bcd76e73e091724cc852f2dc11ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
696B

MD5
5df07cebde8180283916a21b4abb67ba

SHA1
3714a3032a77306634695559622489f501c63563

SHA256
6062b92262a2d51df24376f947794c0fbdc4bb46eb3c2de3d7424442f321e7f9

SHA512
282bbfcddbaeae63cb0c186dd1737149cd143e37571e6345a819c9751d18d65e61c439de5baca6e835ad28fc4fc6a4b527cf14a9b1019abf9b258ccad5076e9e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5d289a6cf4039989f7903abfc240b8a8

SHA1
624ad0a82fde2782ead04e5daf3bfdcf6dc7e70b

SHA256
c5971a3a03fd0193a482d01e75589cb7ae15d7d4db41a73ef3b6bef9c121edaf

SHA512
7518642941d728ebcf938be49c478ec6568c56e35f625b7fad37eda7ee34c917edd0f4277ecfc7b47eab275810073f234c2dc92167c5246ef4db47c2e838718d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
19afde9859a2ee48a42918c2423566ce

SHA1
7712813afadee9bdc90c74cc0b8b45f63f7a74ed

SHA256
1a747131a981f8a2bc87019c36b1266c528545a601453d3a1dc80ce8f9e4b139

SHA512
1185c7d17769fb04e1d19a40638089610e767164c51d245288038dee93fd5f790829d83f1427ab91f534b7a2e07c0a59e597be0a089503e8b2d603eb17304a8c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
93abfffb97342a00834527357c862435

SHA1
ff9601b83f45a6c16780ab25028f7a9a630f2a32

SHA256
f8a530bcd4bb5063cec2d9d62fa9f00889bfc2718a9c6fe90b48c2fb847f5c67

SHA512
4557b68208c4f47478ee16133993ff57344906b9b2b5c1dfb2030b955d36d07fe3152bcc9eaa13c61a9155fabbbcf20cc40db4c409cd784555f5ca28bace3447

Download Submit