f4e10e2f45d0829ad9bc473b47690caf7671b35c076538704eebad408bdd6531

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
14-06-2024 21:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ab8a1ec37a828a02e2e56f141b8c7d16_JaffaCakes118.html
Size

175KB
MD5

ab8a1ec37a828a02e2e56f141b8c7d16
SHA1

d7d495052c1d8fc416b244a31447d6694d5161bd
SHA256

f4e10e2f45d0829ad9bc473b47690caf7671b35c076538704eebad408bdd6531
SHA512

5cf0100518139a711f8c9d898fe8b0c208a6d906caa2d32ab472052b8788521ccf7858db972380de210e5b83f07d6e19d6bf9658c83af1e51490e4e156895acb
SSDEEP

1536:Sqt58hd8Wu8pI8Cd8hd8dQg0H//3oS36GNkFWYfBCJisa+aeTH+WK/Lf1/hmnVSV:SOoT36/FfBCJiUm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4688	msedge.exe
4688	msedge.exe
1420	msedge.exe
1420	msedge.exe
372	identity_helper.exe
372	identity_helper.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe
3160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe
1420	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 3640	1420	msedge.exe	81
PID 1420 wrote to memory of 3640	1420	msedge.exe	81
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 2524	1420	msedge.exe	82
PID 1420 wrote to memory of 4688	1420	msedge.exe	83
PID 1420 wrote to memory of 4688	1420	msedge.exe	83
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84
PID 1420 wrote to memory of 3484	1420	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ab8a1ec37a828a02e2e56f141b8c7d16_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfb3746f8,0x7ffcfb374708,0x7ffcfb374718
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4864 /prefetch:1
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5348 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3956 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,16261538455284152517,10045822577635872803,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1932 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3160

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3716

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
8c40aa4522d5402071c28bfe0baf8a62

SHA1
d66d0949a98ce1b6ae8c031b0305e7163f99c0fc

SHA256
88733aa98f4d46e7d88e82c40cd48bc3401934bafac8279b0375bd246c590260

SHA512
abf2900ca0d06dfb21cc9a038e6d425452440d2d893eeca1a7752039c743289522c1184feb76fe4ef36f4b1cb92716e74af4b43a9a989820a0318b719df04927

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b86566a871e101484d4837914a05bbb6

SHA1
bdb84770f7196524a20bc786ae1e6a3b63a2cbd1

SHA256
aa577d607433b613d22ce1347051d2a3acb5e5eea317f2486166a46c58c9d7d0

SHA512
55515cc583c0af1b38c2af326f42515f5c3c04630dd88e5d4be6d95e3c973e40cb1dab33a6a3c9bc8855e38d1c93fd4ac137498ef3cfb88577a7c7525c607118

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6e4079332ec42b404ce2818ddf7f8a62

SHA1
29dde618367f5bbd0c90f410d5231bc421a355f0

SHA256
b6a7b86e117810bc240e74fe84c9dd13ef35c0405aaa7804d41f5b5e554aa3c6

SHA512
c645fbe3e01a02d3c455ab02598ad0863797334b23a912a8d467eaeb863c637f2d3f26d5bc3fe85600bed0c2860df9e17c7dabb2426110b260ac7a7d4843941b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
14342d3a23ff05d14c1db1139aada4b9

SHA1
72e5c9c3c51c15c371af3859d1a2763047c51ffa

SHA256
a1769526d52c7b7b77c7c53aca4b90cc8c4b738d0296148a93425111dc5639cb

SHA512
fd80ac2b63922372417ca3222e6b2fcf9968d60705e39a76790fa53fdd7fe6b902e43efa1e66f4589d1e38d8eedd7ff3da8772f21d3d610e3af88b5af7c0a568

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c30fed35-eb86-4e89-aaf1-f4bf8b75e560.tmp

Filesize
2KB

MD5
e5d1b48d16254559951028221df5e281

SHA1
81859d42a3392c88f2d740996522fa4f64d8972d

SHA256
ae0bd05c1ea68e33ec93dedacc8f5374e07b7680f09e6a917ae52fe628713b1a

SHA512
14f8738444137f0f84b12c75c803ac5af2545527f9c00c759875f9357edb4dfa2c27023b5b691133e2c75f90cfe1cc227be93c0c4cf11df18cbbe437a66a317a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b87420a9d82584beb56386dd5da3e570

SHA1
10a2275b784eb0e45853dcc319fcd6ad6273b074

SHA256
95c192885524359c6afe070878f00990eb54b80296bc289d5d82f9189c463dd3

SHA512
8e3ba10765a5a032435e41cef02543d011bcfcac276f5f58d138bdb8f872a230f83ecd6ba3e2147798c9d2dc07785ff14013e813cb76ae792b5ab538361e0b2f

Download Submit