dba8e9b1f272992e81bc76119da9c2e9eb7b77d8dc547f40c029e67c41cc498e

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17/05/2024, 14:14

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4ff38fe181f67f4a154a0604a1da4633_JaffaCakes118.html
Size

32KB
MD5

4ff38fe181f67f4a154a0604a1da4633
SHA1

66867eaad725bb7d655ddb4202c1154c289e0e85
SHA256

dba8e9b1f272992e81bc76119da9c2e9eb7b77d8dc547f40c029e67c41cc498e
SHA512

e04899228a5ef3dc03b63fa35f0d90fe43bb207e3f3c19557b65c52030a67e7599dc6a9fef06b70ad93a2d6481a09adb5533f8b1924dfbbb71dbb769a307d9a4
SSDEEP

384:FCmjyBZLMQY0gmfB7MHYotn0FCjRSb2MGuffXpgaOedJPmcSpO+4kfm6Nnv:kmGBZg2K0Y3MgaOmJucSpAklN

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1337824034-2731376981-3755436523-1000\{3EC7CD6E-8C28-46D1-89BC-EDB8CD515767}	msedge.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe
4472	msedge.exe
4472	msedge.exe
4400	msedge.exe
4400	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
4760	msedge.exe
3980	identity_helper.exe
3980	identity_helper.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe
4472	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4472 wrote to memory of 2900	4472	msedge.exe	83
PID 4472 wrote to memory of 2900	4472	msedge.exe	83
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 4752	4472	msedge.exe	84
PID 4472 wrote to memory of 2028	4472	msedge.exe	85
PID 4472 wrote to memory of 2028	4472	msedge.exe	85
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86
PID 4472 wrote to memory of 544	4472	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4ff38fe181f67f4a154a0604a1da4633_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9b7db46f8,0x7ff9b7db4708,0x7ff9b7db4718
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --service-sandbox-type=audio --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --service-sandbox-type=video_capture --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5040 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1732 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5088 /prefetch:1
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4636 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,7794000751232073268,10956093455263229078,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:2512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
665B

MD5
2b8716266db222224d660b2f07f9537f

SHA1
1581b3f2b0fc316b946552dae5a5affd6d55056c

SHA256
2f03f6806ed7ae78843f3cfa6a84c615c93d7e6cd1376167e3c91c07aaf8732b

SHA512
bb5e6b4c902109ce07a928074fcb7a0f35874fdc97b9259f98baa5668d882d8624959060a5bc352f38e0c1692903a3f5b83b9314b642d6c165c4fc8d36c00521

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
853f33e3478cb71759627abc218d230f

SHA1
9f708a78e7bbfa6c882b27539f0445db873c345a

SHA256
3d81a5ac63edfcfa9ec9a2c5862eff370290333e0afcabad89d7fc412c0ceb46

SHA512
52b2f8123bb821d1b20c2183fa7ab9ea2aa9836cd1b28e0df0229215852df21e6fdbdb56b88c168f53319331e5fbd37a54f9020b09d652d278fdbc0846c492f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce972521f119b0a1c192e78aae124fbe

SHA1
444d6082f78ac0651e861c324e07cb5e38de2be4

SHA256
7ef694f38b49a4a4e343ae7a74c0c64a378445f6767d316eef74438381574abc

SHA512
1cef5b5099370ee50acad20874cab23a075f140ec9d11cb190cb9e327dae66155cb951413d154d02aa8077096c1db9464cf0b51afadb577c9963db30c36c14b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bdbce3d1b917b085796fc74f3b3e36c6

SHA1
477b0f5bd1365f40d57487bf7cfdd9ad6f401c01

SHA256
2c1a44a97076f195650cf1e3e10a21385800877ac8421f1c07644d4437ca1265

SHA512
6cbf70fb377958ee1a11a80cc49f6536d3bbc6c321c9f5355a975ffada5a863831f60cc2ce40cb70de9c36ea8dcfce8d14baa3682f0e8b84115b77be8cc9e673

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
9af65fd8c754487f8cdc04e142752544

SHA1
bb9aeca1be10b8c0c8bb43538fc667fc12fc1644

SHA256
2d286022e89fa854a773a3274365d9d8ccb758f8cc8f3bee0b3db70e399f3100

SHA512
07e9675ce4e4da61402d6daac6f5ab94506dfdfaa10aa71a1a58776089efd46cd2e85d29c116af0080169ada448c4aefac9808ecb246bd38695e25b0e313ea0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
372B

MD5
521390a0f1c29c1bd749e0ec7fb74df8

SHA1
2184d26eae95d0ecfb0dc44f92781c0f4df3dccf

SHA256
3248a3eb3c1e513ee2a4dbf1d2cf6ebe14f6124393ceb7754689a97fc10bf33f

SHA512
9c0bb7205e90cd88a764cf0864e8adc159000ba2e18180b2be618e65719da3d932a8ac435be4fea338ccb6d2bfe68f264a561ab43dc7b1b6838b0e1d0af8bd6c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57ad95.TMP

Filesize
372B

MD5
346cd73d6eee365f05f43abefd3e887b

SHA1
b1be391d23c01646e9a665b3a21180003073a008

SHA256
22635c6f595163fbb229da82088dd96a8f26895ddb31d0a8eacd682632e89e89

SHA512
cdbffae40791bf0f5b9e23c82c940334892ec580bf091ef78540a853acacd5e407208f1b30f3f5a6f8ec3f51bec383f07b45fd03a28eef189958f5b3c022d275

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5fbf37853d877f527a53140567f26290

SHA1
417af9ab8f374a5bce00f004ea62011e41fcc4d6

SHA256
d2d7dc858c9289700156e75c0e92249f93376437583ca9ea4020a5d3386261f2

SHA512
ca0767ac5c467a6c41fd08b0d035f17fca66dc7404be8d4809c257d5c046a78f951cf185dd14e4ab36e286b1e61b7da38b6b8e689f135c90f9033afce95f3d8b

Download Submit