a2f68be6edf2b22104bff7ef8d33efd68b5d20837981f6ffad4e3de400c0b043

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
17/06/2024, 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7473a13a9c111a5d60f30d648f03b83_JaffaCakes118.html
Size

53KB
MD5

b7473a13a9c111a5d60f30d648f03b83
SHA1

ce93fe7c55b77157fee39142b80f0c27a467ed59
SHA256

a2f68be6edf2b22104bff7ef8d33efd68b5d20837981f6ffad4e3de400c0b043
SHA512

51dd5af394ecd64c161f13e642eba968b154ecf5e522e0ad72e661fea82e70cedb7e2e56df41530275cbbc324133bf946cacb9db59ac13c51e64c6a46a432927
SSDEEP

1536:HDeBzhpn7RyQBy949k6xaqYFGUD5Qv3kvAs49uWBS/XGf1aKMtUF8:HDehhpn7vB/6eavGU1QkiBS/Xy1aKMtt

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
11	sites.google.com
31	sites.google.com

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2792	msedge.exe
2792	msedge.exe
1912	msedge.exe
1912	msedge.exe
1032	identity_helper.exe
1032	identity_helper.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe
2904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe
1912	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1912 wrote to memory of 5068	1912	msedge.exe	82
PID 1912 wrote to memory of 5068	1912	msedge.exe	82
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2692	1912	msedge.exe	83
PID 1912 wrote to memory of 2792	1912	msedge.exe	84
PID 1912 wrote to memory of 2792	1912	msedge.exe	84
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85
PID 1912 wrote to memory of 224	1912	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7473a13a9c111a5d60f30d648f03b83_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e77d46f8,0x7ff9e77d4708,0x7ff9e77d4718
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4220 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6452 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2148,3590133875661637182,5337150113204634211,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5184 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
8dcba647570cc6a502c02c2291d7744a

SHA1
334a125e57ccefffacacf91f4a0f03341f9b4a3c

SHA256
57a6479d97f28d455dba70707fa544fb4f1fa9bb09d9f9acd3faebd375223872

SHA512
6a8d65ce07f60c0895b197319741f488d352938ddc98d7c091a364ad4e8931e91f759cd6980eb83a8ecab2577d8f3444b3ae15f091120374a5e9939049d64e0a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8f8aecf25302986957883b8d291a0cc6

SHA1
c8a42527febca102082a5568216441b95dbf695c

SHA256
00f3d53dea6182a70d1dc9a1a0aeaad907e712afb1c44cfe832defa628e9e316

SHA512
978f3de3c9d07627e77e4b427e080664659b6d86ed9812170d8537e03bfc1c28ad5a6aa928349b3cc7dd57784fe12a1137f48bad3b8431ea0be754a339e845a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
18553d6606b8bb9324e9cfffff538e23

SHA1
49604678f63e4cfbe5f093bc4c73a312c2b36cc2

SHA256
d9b17def940490515ead527a8a4c3a14cccd7e2fe90b8204b55e52a0f9a8696c

SHA512
abd94c8b9b4ed1585c1e77b51f0d39e7c333cebc5df38df54d697c66c66a1486620f5f2e77c9df1c2481c76942caa201488416fbaedb9e91587ff25e81f1ddc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
365c048e8dad4299313bad7199644d54

SHA1
67cff16c6bd0ceb8a877a03eaa4680883e44f5d4

SHA256
db2c54195f042f7668a6e50e571ce983b384684aa8899a3909b2f56447aebaf4

SHA512
c8842651b56389ceb0c15cb1d3c3ed1806d71ef4b3c96a08771f2b4bdfb27d0bb350a816bb9d3c2806ab55137b9d70569da17afb052afe2dc42c08af94ced624

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9ce16c72d8256eca155f09fdf517315b

SHA1
f1720b9315df174f65cf3333cc4fab1f886058da

SHA256
13d02b3d5df1979bb79a05a417eef3a6fc7eca398e5d902ba5a720cfea5545c2

SHA512
24f2e6d6549eac93b8df91de07091d9bd600ecac17229a444af265e14d14e48f4c194bf251f66e1792bc21b746a5414366b2c604e19d9df389c419f83c32b4ff

Download Submit