afa9165461d9b6184cd7d4c326182b6685bdae8a02adb5a8a109da39d363d0be

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28/05/2024, 01:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b34ac38addda6ef8c66a740720ebd3f_JaffaCakes118.html
Size

72KB
MD5

7b34ac38addda6ef8c66a740720ebd3f
SHA1

e92c593498b6f1a1d6c92fa6aef6a3ad2b2ea055
SHA256

afa9165461d9b6184cd7d4c326182b6685bdae8a02adb5a8a109da39d363d0be
SHA512

16fe3014c2e1f94044fae0f93f2b1d441f48ba8ab789cf15d37702b75dc721b23084e54430fa8ba21427bcfdf4dbb7b7772ab67311f2653035e59b254e1e63e5
SSDEEP

1536:fbNCwqBqMjeZdoSA64A6ps+6Blhr511Cc1YX2OjH2vdJz9ZqW1OKFzg71:jNtcqMq1ROjidJzqW1OKFzg71

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2856	msedge.exe
2856	msedge.exe
992	msedge.exe
992	msedge.exe
464	identity_helper.exe
464	identity_helper.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe
1692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 3964	992	msedge.exe	82
PID 992 wrote to memory of 3964	992	msedge.exe	82
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 1256	992	msedge.exe	83
PID 992 wrote to memory of 2856	992	msedge.exe	84
PID 992 wrote to memory of 2856	992	msedge.exe	84
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85
PID 992 wrote to memory of 4956	992	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7b34ac38addda6ef8c66a740720ebd3f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8ad3946f8,0x7ff8ad394708,0x7ff8ad394718
  2⤵
  PID:3964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2736 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5592 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,11149292513253806551,6383735499641995016,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5560 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1040

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\89331238-66c3-42af-b6d3-2fe836fff532.tmp

Filesize
2KB

MD5
22b738e186a7df477b5819533c050a19

SHA1
024633d3d2bf1e581ca97a64934b080458bab99c

SHA256
cb7593cb4bc513a9353de3690390c9b1aaa047347d80720111463b77c84d0bb5

SHA512
a7dff8c4ff77974e017b57e4652ef0ca19201b14217024b28b370cf9c522b30a2f5bccfd7cfd7d48b218bd7dde6b9a04b08d31d5e367e97c3b861f99d9233da1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
20KB

MD5
b6c8122025aff891940d1d5e1ab95fce

SHA1
a0c7ca41d0922d085c358f5dde81ae3e85a8c9c4

SHA256
9954c64c68000f615e5066bc255eced1195d1f8b7dbc715f9062ddf9f147e87e

SHA512
e62a37b55b6b8d95c24fb624105ff6ff72f118e31760d0da1e8df8e8acf627ec6327c26dfa26df8535585877604c7948d2f621ccabc39beec49787e22c302c10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
dc3245e4273f1f71ca7df02ba30bf58e

SHA1
7cf5e7bba11bac063bc58242ba2ca0c59b2f6f38

SHA256
2cf853ba613aa5d06e45fa50cda20acd77568017bcded06550ae07156acee8be

SHA512
c9f4aae5361cc11408de9b3c8638582d1ec59b326667a9ebc2f901406de9d4890481b855ef57e8c3ccbaf698b1985fdb46734b59080e972b7955356e79b6da52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
461a7d6f28216f24a5cf77dd02b532c4

SHA1
f1b972fae114b0e948b2562d15659de699c0c1b5

SHA256
fd9daf3995c3e6bc4d9247e01ddd52154abcd52083d3f677b0096bb6534b57cd

SHA512
90c665e614e562dc66f221ddc8166903d7fb3c30f6f67d8f9e0cc294c87af1e4655818a80fa299fb29178d06f74b4ee95695598900c4a65b6e242d6d59b9edb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a1c11b84706f8735d0b4cd4a10220401

SHA1
1992c256722f2c57560fe9e4c6cfd2080d2c1d52

SHA256
b4897119d7ca6142347437a064d98ae59c631d2e4f826deee3e4e47af8052542

SHA512
87de7ed25d087fc44f544f146cc2cc7e573d443b76134a0ba4087c5498ef2e256ef18b877b756510a6b10bf83007897274bbf01df2cf7b0bce0133ed890c8b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
477d568e411d2b6302a3f83c38614493

SHA1
ae8e23c132686465ffa3a9cb2fb2700ca8e76974

SHA256
0f50aa4bbe96bcb6ec1be24003e5effc7cab95dd8498b38ac18d8ceb0130c233

SHA512
c1ffbf842ebc8ad4cfdba6fb1b99c0560a1d4cd9b331f8fcabe7543818d453045a660baa0d82bac7a020fa7a13865256e806ef9483f95cf52b1e70e97212f627

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
353063a66f58adf0ae0d0f58e7dfc17e

SHA1
f759698e85cf5ab4e5e89d7deb3726bfcc83ff10

SHA256
b9d55d12dd11842c1243df5c31361faf224772cc975f78ea7c353ac47c634374

SHA512
149e4585844384df76d68480edb65cbb1c3539279f4ced845a9d79eef8c5afbe578a9ab42c4b235fc0a2d3466a63e1a8c48cc2a69fa20089236411d122c9c60b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9b670e599a1c118a778e61cbcf4aea33

SHA1
ebbab2dc30fcd0d2fb447482ebe25dcb5c03bacd

SHA256
3697395dde7d369fb2c026be7d101334d73f73a6fbad491342c2bca7aba06f8e

SHA512
073a74a9f21b7faee0932038e07745e8071583ccb57e6dee9daf1c4022c6e4dfbc26fe5ce1c7da582bb987eb96edd66c52edb25226e23e1d851ce8a089cf0611

Download Submit