Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    145s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240426-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26/05/2024, 22:10

General

  • Target

    76f36ccd3d1fe9134fbcb60d305b139e_JaffaCakes118.html

  • Size

    74KB

  • MD5

    76f36ccd3d1fe9134fbcb60d305b139e

  • SHA1

    e87378894cc9cb45e87d7137612e52f90b85a4c2

  • SHA256

    d7df7bf267937adf6c4233421e7ae4aba9215b318c12442747162f6e68ff8ac0

  • SHA512

    3cb721a61f9782b99eead316df8cf9578adbb6e24ab6d8cfab764486bcc6996c6854472570222160e35ce00df46ee80c8b1c9bf9bae83ce0dd261f60063fc963

  • SSDEEP

    1536:gVSKpmvdActBIsEAcjeNGB0eAcKAc2wm6lIJxchS22lQzb8t8U9NCh8YVluD+8ne:VFAcQfAcFLAcKAc+6lIJxchSjlQzb8t+

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs
  • Suspicious use of FindShellTrayWindow 25 IoCs
  • Suspicious use of SendNotifyMessage 24 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\76f36ccd3d1fe9134fbcb60d305b139e_JaffaCakes118.html
    1⤵
    • Enumerates system info in registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3880
    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc468746f8,0x7ffc46874708,0x7ffc46874718
      2⤵
        PID:1600
      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
        2⤵
          PID:1096
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          PID:4024
        • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
          "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2220 /prefetch:8
          2⤵
            PID:5096
          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
            2⤵
              PID:4920
            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
              2⤵
                PID:2360
              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
                2⤵
                  PID:536
                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
                  2⤵
                    PID:3508
                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
                    2⤵
                      PID:5024
                    • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                      "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
                      2⤵
                        PID:2288
                      • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                        "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6172 /prefetch:1
                        2⤵
                          PID:724
                        • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                          "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6676 /prefetch:8
                          2⤵
                            PID:3412
                          • C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6676 /prefetch:8
                            2⤵
                            • Suspicious behavior: EnumeratesProcesses
                            PID:3996
                          • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                            "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
                            2⤵
                              PID:4512
                            • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                              "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
                              2⤵
                                PID:3644
                              • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
                                2⤵
                                  PID:4908
                                • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
                                  2⤵
                                    PID:4436
                                  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
                                    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,16378552980860494930,14387908980304520423,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
                                    2⤵
                                    • Suspicious behavior: EnumeratesProcesses
                                    PID:364
                                • C:\Windows\System32\CompPkgSrv.exe
                                  C:\Windows\System32\CompPkgSrv.exe -Embedding
                                  1⤵
                                    PID:640
                                  • C:\Windows\System32\CompPkgSrv.exe
                                    C:\Windows\System32\CompPkgSrv.exe -Embedding
                                    1⤵
                                      PID:1832

                                    Network

                                    MITRE ATT&CK Enterprise v15

                                    Replay Monitor

                                    Loading Replay Monitor...

                                    Downloads

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\070E0202839D9D67350CD2613E78E416

                                      Filesize

                                      1KB

                                      MD5

                                      55540a230bdab55187a841cfe1aa1545

                                      SHA1

                                      363e4734f757bdeb89868efe94907774a327695e

                                      SHA256

                                      d73494e3446b02167573b3cde3ae1c8584ac26e15e45ac3ec0326708425d90fb

                                      SHA512

                                      c899cb1d31d3214fd9dc8626a55e40580d3b2224bf34310c2abd85d0f63e2dedaeae57832f048c2f500cb2cbf83683fcb14139af3f0b5251606076cdb4689c54

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\070E0202839D9D67350CD2613E78E416

                                      Filesize

                                      230B

                                      MD5

                                      bb86c4215ee2e6872603f0291dfd7d60

                                      SHA1

                                      ca42f0a45da212e608cef8d7084d6b82b620b24b

                                      SHA256

                                      ad3113cea78d3a0c8c52e7261fdf1948684b711249523056847b98a94d68b138

                                      SHA512

                                      23f771819571b990b69a72fd6479ce9c163c69c2c124f6b87a6b7833d39bff3575aa646bf89eb07d3ff89e03852916b844ffbd97edf5c8c45c9f1d551d805f90

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                      Filesize

                                      330B

                                      MD5

                                      b6b1133e75d3b62af1188db484a006a3

                                      SHA1

                                      e2ada3c79ae65b9ad79797a1881f971b001e26ce

                                      SHA256

                                      697a9cdfaecb8fb8638873325f0bc72d8610c5174a44c2e460a1793ce29891d5

                                      SHA512

                                      52b3656ad828c502f9387509f608ad2cfb2930d6702ff113e17a58c50542ada8fc8cb2eb7e42bd36d202e2e4c2044a07d532ea9f9f13d7bdc6cae16538457cb1

                                    • C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

                                      Filesize

                                      330B

                                      MD5

                                      ee75c319fbb1c128a84d9b2a58d02609

                                      SHA1

                                      d2f1b54853ae481a1136542a0d1f1be893c44d8c

                                      SHA256

                                      28e42ed20ae8afe99c8056359656bdf5df35f0c6f1ac946ac3d206a22f06abaf

                                      SHA512

                                      98c6a7b12f40551aaa34398d9f0bf8a538bc6587a244b769e0134299048d4ace1535833743df601541e18ec3b7c787b49dcf952cb5230cecff6643ba11c0e567

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      537815e7cc5c694912ac0308147852e4

                                      SHA1

                                      2ccdd9d9dc637db5462fe8119c0df261146c363c

                                      SHA256

                                      b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

                                      SHA512

                                      63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

                                      Filesize

                                      152B

                                      MD5

                                      8b167567021ccb1a9fdf073fa9112ef0

                                      SHA1

                                      3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

                                      SHA256

                                      26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

                                      SHA512

                                      726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7b5c0802-4313-45f3-8d9a-73b7622621d6.tmp

                                      Filesize

                                      7KB

                                      MD5

                                      05e1a2a4dfbc445a7463c6410c8646bb

                                      SHA1

                                      9448f4221c7934b2f96ff77cc98a221670834946

                                      SHA256

                                      041d69ecb17b0fbfed50d48f8eb006471be99cf72384505827b2259cbabb9ace

                                      SHA512

                                      c2ae801ad55f527f5bdbfed04a4a78187f06c296aa89a4d007605c0755d4db151652517824f6f20bfe78bd367e07eb4bd936575f942b689edb41c144797c6c16

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      144B

                                      MD5

                                      9b4f3838596e4f8285cefa91b78fe2d0

                                      SHA1

                                      b8f00dfb9c26af6fc2e53004e99ee6700e292be1

                                      SHA256

                                      f2e966fbc561236c27b13540ed00281c1b7269adf69c54192c05d04c99b1de9c

                                      SHA512

                                      e592003ea78e2c018debeaba211215ea0ce55a4d342e230731d51f351441562cb209348bdf0c8b59d82a0b0973df86e320059541709b5395a39b3ea423762af1

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

                                      Filesize

                                      168B

                                      MD5

                                      a71b2917cc61c7633911d4e8b1549132

                                      SHA1

                                      8e36b125eb76fb948a973e5d424ad0f6c8a6d7fa

                                      SHA256

                                      9805de5f6c33d2c81240786294a078c0ced5f46570ac30da61b0e71e008c3404

                                      SHA512

                                      c163d8e55d3ba4f39bde57a5139b4bcaa37210b517446b63f10602ef520ffd2fd02d93557dc6d214993701032fb135488da4fe08f7ae14343fe375e61ea8378e

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      2KB

                                      MD5

                                      8548ecd1b6803503bb3d2a6ae0726da1

                                      SHA1

                                      fd19805a877927206f233231611bb5633df08f8a

                                      SHA256

                                      da988311862fcbe0a590a6e950d8ab631287fd38913f24bd52f6e10e5353bfb2

                                      SHA512

                                      f03dc3563d7a8c78b4768f106755b3d4b65e1841c434c9fac463dd7f337568732201f5bb2bff772ce80548943f92a5f43d46ac874176599e43d11a7794be3b1c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

                                      Filesize

                                      3KB

                                      MD5

                                      8af198e506fd5ef8ee6a7e464e6e0745

                                      SHA1

                                      d07b25504ad4f1b8ee4837de61b9ede8dd6ae27c

                                      SHA256

                                      82a0f94d91384f6f04b098b47945701138ea9cb08a6bc54e448665dadeaba3bf

                                      SHA512

                                      a8c4ba4f95163560df51e84031f7bf66a387b20f0bd7a5328e3b21bb7b3b75f0eef1bf82e300ab92f7e9eb998bf609fe7b8dcc1a1466312650a026483fea6c7c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      5KB

                                      MD5

                                      bf923a569390e1856c92111e8ebbd39b

                                      SHA1

                                      bf01435afbd6ecdee9245921900d99960e5b7b53

                                      SHA256

                                      b6fe9f018a72653b5cdf220c4e7743d81f5b0c5c0faabce05f2777ef0d657db5

                                      SHA512

                                      795baa27fe1f9f4c863430de2535b82658d3388ce0e3f037fc86439af5967136bb52e377f47b3f3431ab49348297aef9005a78bb91f20d443dcdfc5a7ae3496c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

                                      Filesize

                                      7KB

                                      MD5

                                      76b784f6c1734c59a2da5ad5cbc33806

                                      SHA1

                                      717e5d6411210a88a8aa449a8eab44efa9d37571

                                      SHA256

                                      3b6fd7463c5dc0aab6cc531675a874910b442b2ce988b108d016f6d5a220ff7c

                                      SHA512

                                      e9c240752dfeed97f11b238c6ab4dc9922cd57835ea5eebbdafe42f132e28c5b516146913f2c684e293bd1179ed97bbda2a2edec32aae50c452e4e75eac5a450

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

                                      Filesize

                                      538B

                                      MD5

                                      a31c75047a92f886bd3095f8e6ae6b07

                                      SHA1

                                      f88254d97bcce4b9d85a9eaa52edf0f9c8647396

                                      SHA256

                                      173ae237f2aa25733e76d9b34d2da704d1babb073a350dbc37e148332b002cbd

                                      SHA512

                                      39895b05c4a953538496b952e5de2b87701aa7c3a503ef8db3124c0075da7b779c3134d962e46005dab0f4bf7bf813cdba9c41898ad10edbd024d2652369458c

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe586d6b.TMP

                                      Filesize

                                      538B

                                      MD5

                                      9d4220ce0a6673c88bd8ad10fcb74e75

                                      SHA1

                                      6809ca4439da5865bdf5600dfb1a71300fa5a972

                                      SHA256

                                      6cb242ababb915f16dffe112c0ff09b821bddaef38070bbbd8efc69e4e43e707

                                      SHA512

                                      61fdcf03b7610eb5c9c4f127ea311f92f4c14e2a54d30208e287ddda7b72f7b31f37691cc85fd4c32f0e0203e2beb5d49b1dba739f3abbfc7795dedcf812d207

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

                                      Filesize

                                      16B

                                      MD5

                                      6752a1d65b201c13b62ea44016eb221f

                                      SHA1

                                      58ecf154d01a62233ed7fb494ace3c3d4ffce08b

                                      SHA256

                                      0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

                                      SHA512

                                      9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

                                    • C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

                                      Filesize

                                      11KB

                                      MD5

                                      e18cf8c89ddc9d5a7621ce59d0b858a7

                                      SHA1

                                      046eacccb7add22ed8712119d1625bff97070358

                                      SHA256

                                      c591bbecb92e0277f3c4337c9f31b3bf847e205565eaece9798410e13cfc5906

                                      SHA512

                                      88215898606fd58b034584df658dded8db9c2ccb88195cb358a9eba7eeaa903fc08fd7715074c80791068751d42d90e094d504d48127e1c8b2ec5db65ad4bc62