51250a5a45495dc50364fc5f8df4e2defe702fc854629f8c7e9a47db17037040

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
25-05-2024 23:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

739287fc9ee6f1c7ea6070e75b712446_JaffaCakes118.html
Size

31KB
MD5

739287fc9ee6f1c7ea6070e75b712446
SHA1

4d1aa649cce452ce49689dffcbd71a49816292da
SHA256

51250a5a45495dc50364fc5f8df4e2defe702fc854629f8c7e9a47db17037040
SHA512

75ef03d7ed0115306c65f22cdbb4e00710a6dde82e236b6d76d7d8b587a8e6778fb407b3e4ebefcf7888916caed61e96be931114dfad4bfc0df6044049275846
SSDEEP

768:aX0w3M63EWBS2lJTJlG3BVP5XrMyC3gVPu4f3I3t3r3zMb763nBCtdEES:aX0w3M63EWBS2lJTJlG3BVP57MyC3gVU

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5084	msedge.exe
5084	msedge.exe
4196	msedge.exe
4196	msedge.exe
5500	identity_helper.exe
5500	identity_helper.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe
5944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe
4196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4196 wrote to memory of 1280	4196	msedge.exe	85
PID 4196 wrote to memory of 1280	4196	msedge.exe	85
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 324	4196	msedge.exe	86
PID 4196 wrote to memory of 5084	4196	msedge.exe	87
PID 4196 wrote to memory of 5084	4196	msedge.exe	87
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88
PID 4196 wrote to memory of 604	4196	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\739287fc9ee6f1c7ea6070e75b712446_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8e77046f8,0x7ff8e7704708,0x7ff8e7704718
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2624 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:5512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6700 /prefetch:1
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4080 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,10957995822947495215,8397086048975475253,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
ce4e5bf84f7762b05461a6a11b554d6e

SHA1
a7b9f41fa5d8172191ba3d3e70ac826e7268e187

SHA256
1376f8da3f16ab5e5033cf23f67be74120f60d8e30e9f97748008e48830e7b2f

SHA512
a76506385162820ebe39a4ae42202d34d68d2c7b79a6dd4258cb29fa89d8f9b6d55449f8a7f9a362465cc258afd13509ff9ea37d788be33c249c8de8dfa859cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
23355f87df6f6d4f795753551b341930

SHA1
0821bb78b7ce8f9f37b83d581459f3284f93265a

SHA256
07c6b2c1dacfd72497497089bb10a1539dc1fd5bec88908a98664b87d2411d65

SHA512
40bf3acf9e2dfcd40ece0c44c7d2c0325f8162dbfe324576daaa7f09b0b8b4167a9af989d2ca511805e9495f684cf2e5cb3f613a5d68f12ef5bb459cf2146065

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b028c8041c59d0070f951bcd12ee20e0

SHA1
198e8b309f3333ccfc7fa0f3d77847f8fe6c27bf

SHA256
40dfd9b61a69bfa7b4e656bf484fd76a7297861e81b21dd297c51098a96a2971

SHA512
86c8a218732a4b8c0f63341c2ead4b4d3ab2c53e380758e5759172668ea91863d6fdd1faa88368c97aa79eba46618312da5c795ef32b10e2c52e1618b8f3ff7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e9aaac90544d151fb0dce7f04061414b

SHA1
f6227097db32983f0f7082c8d3d67eeaf62b197a

SHA256
d92914d9bbdf02bc6aaf6e192e6ee283f0997cb3533bbe254f286f66ba51cf5d

SHA512
d38c33a7097fa2dadd5130a9454780e682c2679fab7c2397440760f57022c5c13573dddb5d47d76f2d17386e80d41f4a1de4180aadd9c4459299cdac2788ab48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f78fe1e468acbdf6209899390b1bb7f9

SHA1
059b15ffb47d243f6e66aab2623faa796ed362bc

SHA256
b9ad5933a0ff3fbd6585dc29fa6ca2678ab344fc2198cee03e3387a2224e2b95

SHA512
ea86b029ad7e5a26f3ce674f2b77e4cbdcd143807579996e3465ae3fb2ba581376a85377b778f8e878d968c0d33211a59152588c258321364b514b15b0a54274

Download Submit