6a1438e1891b9cb3e8625f8bd84d420c3c560256619057129c794b1f074bc08b

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4e5b6bca169f87d2b628e02dcad0d2c7_JaffaCakes118.html
Size

175KB
MD5

4e5b6bca169f87d2b628e02dcad0d2c7
SHA1

dc4a63c74ee01b76e19912d5a15fbcf64096ac14
SHA256

6a1438e1891b9cb3e8625f8bd84d420c3c560256619057129c794b1f074bc08b
SHA512

0be3f98ccc1f915ebbe5e9fcff08b565f1a33e27af5ffece208c6e05c94fa0238c80ea3061a751812729f5f9f34f0991fd62560a46390fff6f580c3ed3aa0398
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS37GNkF0YfBCJiZS+aeTH+WK/Lf1/hpnVSV:SHCT37/FhBCJi9B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1372	msedge.exe
1372	msedge.exe
4632	msedge.exe
4632	msedge.exe
3900	identity_helper.exe
3900	identity_helper.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe
1456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 5112	4632	msedge.exe	82
PID 4632 wrote to memory of 5112	4632	msedge.exe	82
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 3360	4632	msedge.exe	83
PID 4632 wrote to memory of 1372	4632	msedge.exe	84
PID 4632 wrote to memory of 1372	4632	msedge.exe	84
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85
PID 4632 wrote to memory of 912	4632	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4e5b6bca169f87d2b628e02dcad0d2c7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffedb2d46f8,0x7ffedb2d4708,0x7ffedb2d4718
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6200 /prefetch:1
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,18018596110435542487,17902532573693968525,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2956 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1456

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
190c3fea8fd4ece0a48597b66b0770d8

SHA1
3c7fc155497d46a045ac77b4fc0da1de87a7cc6e

SHA256
6c403cc640c19959116a2fe320e87e775259712b9771fe8b47b2ae4fb9aafa38

SHA512
b73dcfb7870a1176d077c102f65feb5e91262266fc3fd166d0024cbbf90b3961b3a0246b8905a96268215186b3f9bbb70d882920c8efa0e8bd85264fe35f00dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bb2bc89ef4474f655951f24b4cb6d031

SHA1
0445a9e93ed5d1ebed7a52403fbfe4c052095d04

SHA256
f97b40b6e429c3937148406bd6b5e456ecbd01e19924615f5013368370a8d5a9

SHA512
035a51aa5a44d1aef1289c4f446436a3789a0f784baaf91a496f67d05943d31abcdf0b9eff0144fa158e11e9b4adf82960778cde73ab1d753181e986de8d22d2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
91dbbc305f96a9a6297699744294b1db

SHA1
9ed7005821bbb9818e6b82d448afbe07b57e8042

SHA256
755a96c1a002a3f2dd686cc94312e5fd7bc27aeb1bb889b92fe90f92e43fa73c

SHA512
3f28b284ca3c5e0049db49cac1d481871c1e6924b7e6dd3de865535277ae142ee5380cb21ee90bb2abb679da1789539ea2bb5c4d0010524dd78ef60c0a1d5da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
dac496c12bef8d7c33a7da5e32e4a857

SHA1
0577299cdd17c98b4255c871d53c2d18aa699821

SHA256
80f05b79d5ce18fe67e95703e2d687851f4a114c61a089a1fac64bfadc562d64

SHA512
d5dc81238fdfcc0ac943515862295bab396dc2a14ad9510fa13120994fd1bff72e8cccba1e8b7d68696cb9306c733cc06b124b9156d71196cef1d4fa1ba50e8e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7aa061d3bf73e360ff3f50f0842253ad

SHA1
800aceb830fdd38bf8c77688e51a4fa2fd182edf

SHA256
5c1f80002fa3a826b13516b0616b59bc2d2b7b1914656e967771b6040897e8c1

SHA512
5c63cf063bb242f0bc65e522c3619ab30cf4522356a74908a242083821cd2d019df614576f5d430da1655666439f99439e446f6075c43e7a5961a4ef80349c4c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
3f5a53849bac4757443dbf1c3df8e2a4

SHA1
a75547c813bc2b11ffaa9cf0ed49e714adbb2720

SHA256
506e8e637a7a6d1e22ac887d520044f670e4c2c09a03cb933bd2c869ccfafeee

SHA512
e80027e8c7f36bec6ee4e2801c62cfacbca60f959b7cb889f13771de7f4443647b551cbc718c840fcb5e3fad90a8870ecabd24dd2711f5dade6fad62194a1c17

Download Submit