321efd41706c3916466aee3888248e8854503204c09238d8f7d0864e74ff6058

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
02/06/2024, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

8f1e9e0cc0179ebad4c815ae7c316373_JaffaCakes118.html
Size

176KB
MD5

8f1e9e0cc0179ebad4c815ae7c316373
SHA1

1c90873521bbeda375735776cd2792c7eb41a960
SHA256

321efd41706c3916466aee3888248e8854503204c09238d8f7d0864e74ff6058
SHA512

3b19d8744970f5346e0093c789bcd766e962363287b25435c97d9aad33a916771f92dae8194fa4fcecdecb794bbdd083908923490e0930dbe7b1187ab4b28b96
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3rGNkFSzYfBCJiZo+aeTH+WK/Lf1/hpnV+:SHCT3r/F5BCJizB

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3404	msedge.exe
3404	msedge.exe
1292	msedge.exe
1292	msedge.exe
1744	identity_helper.exe
1744	identity_helper.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe
1064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe
1292	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1292 wrote to memory of 2916	1292	msedge.exe	83
PID 1292 wrote to memory of 2916	1292	msedge.exe	83
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3976	1292	msedge.exe	84
PID 1292 wrote to memory of 3404	1292	msedge.exe	85
PID 1292 wrote to memory of 3404	1292	msedge.exe	85
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86
PID 1292 wrote to memory of 1496	1292	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8f1e9e0cc0179ebad4c815ae7c316373_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcb3246f8,0x7ffbcb324708,0x7ffbcb324718
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2348 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3412 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5128 /prefetch:1
  2⤵
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4968 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6064 /prefetch:1
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,7766825612151510569,3030782035861377476,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4716

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1948

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
9c96640870ada44c59ea5091eb59e1a8

SHA1
8e9c864012714ff21486efafec65b6c8c07e1270

SHA256
934f15d71d21b1826b8966547c71e0c6bb2b6e00e29a887690c7b2706521bcb7

SHA512
8408d39c948e1d899d03bea8bc2e5c508ad955abc9e11c26ee4d76ed7af5066c2e3cafc39d885513d4a5acf3cdfc2451eceff62fa1fd3f85394af588df76c626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
61be544b7d81768b692e0aa85952070a

SHA1
6f9880d1cd961133c5a2489c4ca273e96b8b66bd

SHA256
5aef37336df0930a0af9ef5cf212bcf99b2f542671d3cfff5172922f5db20a42

SHA512
4aabe313528ec2c29575773380db1c2f2926121984380d56f787174afa1b0448101ea067c5a76b924d4da1467f79e945e861ddb69e9ea9ba0cb2e44312738633

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5e4ba849b89edd9b318643521d95e5ff

SHA1
830468ea7224a48bc515d7d674c41ca1cd813b16

SHA256
a734fb5f1d6e1de28ae2ec55a8e4f69bd66263b68145a372052c93a13288edae

SHA512
4728ed1bd7d1cebdf37fe399dae2f5862ad49e60d88578128c191f5dccbae380c2435d4fd2528a574f1b0c872f1bd531955e8c2e4da9da90b3a8e51c646d9bf6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fa7a15371c2efa654f2d0da6ff4090d3

SHA1
79028083c95ee5305bbb307406ba31160eabcbb9

SHA256
6ce8e966587610883ba10ed5359838bc3042e36d02e567f8da8eb36506422b9f

SHA512
e6407d500dc224bf05be3e4c01b33322d561f7c5e063bbc93a43beebec670671c4f8f8feedbfa245c0807c33674ae6fa1158a41e92a9b09d6e431c66cc27a55f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7f51394b25e89b3587a7a92fec694897

SHA1
c9f473e69e4231a1dd966547e1108d2922e61c53

SHA256
11c67866fc2ba00ed00feb088ec32dbf2246408141810d127c9ab7822b2add47

SHA512
d8fc5f68d9972b5bb8f35f42a39b3631cc174b0182efcab7200eabee81bfe125418a12002eba77a6c11e207490e661db1765f7008255b244f20ec748945ffd9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0e87134176f2b323755449b164b4836e

SHA1
0e22ebed4c44a5224cb30249b0ca4baa279873a3

SHA256
28ebea61a120c732f3efb92d5ea07a472e28e2fdd57485a671f6f1e2450841bc

SHA512
a6ea2c648975a9dbc6272906f99b777371c390b2f75922004cd344447bff2785d812efe95b6ea7c7c423fccaaedd81e6c6358441af032ed72ff8b59e25ca5df0

Download Submit