d60a29d148916c9552c14c095a400235321b2eea61edc15ffc275a927a007233

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
03/07/2024, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

230b281d92004622c467a30444d0ecee_JaffaCakes118.html
Size

57KB
MD5

230b281d92004622c467a30444d0ecee
SHA1

4d606f29008dc4302debff7032b63996ad97c033
SHA256

d60a29d148916c9552c14c095a400235321b2eea61edc15ffc275a927a007233
SHA512

ce1fa2b5aec20e8d253f67c195fd0110e1275f01535546723450bbdac4bad2c7b2f1c41d6840bed504a176b10d110a9cca1c6cf4076dfa9396e9c135e2d69c45
SSDEEP

1536:ijEQvK8OPHdyAMo2vgyHJv0owbd6zKD6CDK2RVroZ/awpDK2RVy:ijnOPHdyO2vgyHJutDK2RVroZ/awpDKn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1296	msedge.exe
1296	msedge.exe
4528	msedge.exe
4528	msedge.exe
5224	identity_helper.exe
5224	identity_helper.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe
5344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe
4528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4528 wrote to memory of 3100	4528	msedge.exe	83
PID 4528 wrote to memory of 3100	4528	msedge.exe	83
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1856	4528	msedge.exe	84
PID 4528 wrote to memory of 1296	4528	msedge.exe	85
PID 4528 wrote to memory of 1296	4528	msedge.exe	85
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86
PID 4528 wrote to memory of 1368	4528	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\230b281d92004622c467a30444d0ecee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfd3846f8,0x7ffcfd384708,0x7ffcfd384718
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2460 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2484 /prefetch:8
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4684 /prefetch:1
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5616 /prefetch:1
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5484 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6556 /prefetch:1
  2⤵
  PID:5236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6520 /prefetch:1
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4120 /prefetch:1
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,954022499965584323,6673665427118435086,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3760 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
cb8bc32943bd0cb3e8cf26cbdd8bd98c

SHA1
8cc3633e74b700ec4cd5e7bfb311abce92df2ecc

SHA256
17bbd87f512dbed91d4f9019747b13bb63425c9db1c9d07d8731bbc7f79a157e

SHA512
1835956ef34b17228a732fd59bb4f9eb6a34901d3644f5550749ad3161085d8bcdabbfd9bceea1c1db8b73277b2b9f6b71d9b4ae21eb9d68273d53b944a6d373

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
44ca52eba7f38b91ce640a1a875fc942

SHA1
b6c42642caff63b6d49ce86fe9b6ed24dc0f49c4

SHA256
92fb7ccf9376b246a52444d4675b1db50eb171f67910aa1e89ce4c24483c623e

SHA512
8c976900ccca0b542f5cb217f0e245c9722c863746b889ac8f94950fd5171313f58e74351a8a48314ea91f7cd0b4b2c67de414f80e36e0b98d8042392f3a03d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
835a4f0effb40651468424dc34af2ff2

SHA1
70b5d3627f2209022e277c10770e506c989e50be

SHA256
741c0220565fdd494c13b96b5c3659b69616331f5debddc4e3307f63109a24bd

SHA512
22da6edff572c6da1219797bbcad1adf71d8c9b326664a75431d6ee4fb0ce9ec08687d8d08a8036f847a25bdcf723bd965694b73e76ceae8daf798709150bae4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
608aaf159d84d960a0bb885cc071b2f3

SHA1
fc4e66f24eef7f80479a7eee3760e11164fc3e46

SHA256
337d0b2f66b3bdf0b347d6394c28ed18bc5b7aee73edade41c01ffc248aa865c

SHA512
458abd60d3d3a93f11497f8abcb22890163542c682334a83c2b83fd70123793da67c72b569211d8277cce4a5b674da5f774a5648b42a3a55281d6b254f9a4366

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
f53f8cb35ff65011e79912956fe6b540

SHA1
2a85d58eb451eefc0fecb1fd7263cf1e80e69f5b

SHA256
c0c43d84fdc6d38f8ba09e9cf6218702d14b631f6baa58695bf29de589c01da1

SHA512
a5eb5b3eb7d5c1370d575b713c98258a376fc774f8638fa5707280e637e262457d7fdba89ac44f45489153c4a1e926f44969f4dd7a9748d5312d29c667b71a03

Download Submit