616c56650b1e363f4ac5751a3651b7e40aca26761afdff5f0a983e3880ac7fda

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16-05-2024 19:03

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4c98d99454832c0729315b2d57547c63_JaffaCakes118.html
Size

98KB
MD5

4c98d99454832c0729315b2d57547c63
SHA1

0a63228caea8de92ba67fbf98187965bbea299d0
SHA256

616c56650b1e363f4ac5751a3651b7e40aca26761afdff5f0a983e3880ac7fda
SHA512

eca941389c8a911e3a03176c241e0b048cba2efe7ef2c2a026c9bcc3a36eed4eb12c4037bcfe72447caaf755ade5d769a6e81199281bddc8113647566898b4b2
SSDEEP

3072:j4E28HLs/5+GMhEEYWNEPDU4A2zAwaoLlVmLb30ubWB39o5FvzBHX0:hHQh+N1NkDZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
1624	msedge.exe
1624	msedge.exe
1192	identity_helper.exe
1192	identity_helper.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe
4408	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe
1624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1624 wrote to memory of 2728	1624	msedge.exe	83
PID 1624 wrote to memory of 2728	1624	msedge.exe	83
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 3360	1624	msedge.exe	84
PID 1624 wrote to memory of 2284	1624	msedge.exe	85
PID 1624 wrote to memory of 2284	1624	msedge.exe	85
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86
PID 1624 wrote to memory of 5072	1624	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4c98d99454832c0729315b2d57547c63_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa84ef46f8,0x7ffa84ef4708,0x7ffa84ef4718
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5136 /prefetch:1
  2⤵
  PID:1772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5760 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,634468321405252346,15715402931581592686,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4408

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2836

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
af391fae9b22b38bdb148e80da5a2b2d

SHA1
2801befe86002da92f7b2b29485344d02bc08f2f

SHA256
c944b2416f7475cc8eb3536fcee6efd6a33a6fc971de2fdd70289ed428c1d7f0

SHA512
aad0d1fe792a0f14753c8d7ecba340ea0be52ad1ceaaf0670b2728cb79dfab8adf914d0b313a18c8018024da313809001c35aa8af5327b2da925e93ba59a3a85

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aac07c70a1cbc4109298f90bc69c9cf9

SHA1
c9e539facd97f628777504189684221fb35182c1

SHA256
04a6ae89b2e412975970edfbe7f7efef184eb938cab4b253549c3f4d04b38783

SHA512
1228c4cc15375097cf0a097771f85d717785209ee6787af9ec5bdcc6ad02842679a1d0bc342846d9069f59332ec2b4a32e83898fb3e24ad75fcd94ce1e4b20b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dd4f282a1e19ebb80bc3bd61d144b064

SHA1
e04363462d2fc9c126465e2116fb7066054d5767

SHA256
04369ac6c50e4607bb8eb1ef9c6c44d36b03253459736779b6d3d0361d4d55ca

SHA512
f2ee7c3d5f465dd1ae6e246c914eefd7eab74cd15bf6e2f5b4781dd6381cb7b52cf5eafdae6e071c75e0613836892f36f9705565955fdf64087390dd268883a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b41923726ea586b66d0e11b52a6d1292

SHA1
9a2bd26c86225d584b5668275d59eea1fd542bab

SHA256
79b3c3fc93ceaa8d000102d267e38b7b7c6aa68505783128b6212a50f3522462

SHA512
7e83e25255830c9dd55413cf56975f476ce11f7d6ce7525ff762fb705741438ec94619a1aa751f72c169f51edd071213d2cb355e2ae5a7caeb79979d60e1c35d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f95dc3d6be84f2497e12603e359ef784

SHA1
68bd827db13f05ef363d459d1647e3667ce16e2a

SHA256
25e0de2ae97f2cdd89676dcaea861ae73c456ed7db556ecc01a7a0f63b1a61a0

SHA512
1d10dd68474b3abe000866e2672522cdf550f189dea53b625aae5d0f46286d5c2837c44563488a9ac3d05d36f8b878e04ed6948717fa782019ea75658cc62fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
371B

MD5
79496d8660e24b1e5a678396a64f1c42

SHA1
97e62b16c9339f329e989e5be6f860472d3774d1

SHA256
556b6b3880601634b538e3af98b98561b6d748694f701d4ad55a361d4e822cd9

SHA512
7863922dc6fc2b45dfed5c7c3223c286034484f6e6f412afb9fa0c1f724a3d1c2764f9d07b3352618e3fede1dba8b329467d852921ccf5d7004f8394510a6ffa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57c822.TMP

Filesize
203B

MD5
94addb612aeaa3ea91e52eacd717bf4a

SHA1
26608dcc7b5e5d60650494625a1f145b0c450fb1

SHA256
0f883029886c5c7587b6eadab37c1a136a099666f6258d04c67cb83832cc587f

SHA512
7776f736b7f24a24d8afe0f8b2efc2e0e7f15b59e985e623fef97a30941fffcd8427e5043c7b8699bb51c9b603f5312342391dbb5d7b972d1124c029c25c370f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ec2c14dcf219344e64c248fdd145aad8

SHA1
5a06ebe743e793e02d553bc294d476bddc4f30f9

SHA256
507357d78a784c4fb1369097c68b4ab81ac2685a88fa16994a000d261cdf3e01

SHA512
28cf07b00fef8874bddc7e93ff11e16dd6e8a23977ef9fe9246a6f046ee189f2898c5165afcc25e149ff7067425aa45c12e69c6bd5c8b4b6c7ff9e7908f6ccd9

Download Submit