d31307610e51b076e14907c5c567f2e5201c6b0dea8b5bc9b98c3b36449841cb

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
15/07/2024, 10:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

497498f7d6b7e1f40bcb1e52e33e91d8_JaffaCakes118.html
Size

51KB
MD5

497498f7d6b7e1f40bcb1e52e33e91d8
SHA1

f2f7aeec6b2a216a1f0f27d714deac35293bf64a
SHA256

d31307610e51b076e14907c5c567f2e5201c6b0dea8b5bc9b98c3b36449841cb
SHA512

b26c1a8915639fda3b96608ba638dc3cf974ea91972f9cea0171a45dc1755b37197a1020a42c94bbde3c90790e7a58a6788d897f7c10cc33370a379fcadf52b4
SSDEEP

768:ho13JcDKyHHHWylo6E4DOUGodVhMcHo+qJAodVhB7QOu392qSVUt:jDnHH2gDrCodVhMcI+qJAodVhs2qeUt

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1716	msedge.exe
1716	msedge.exe
1528	msedge.exe
1528	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe
4996	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe
1528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 2192	1528	msedge.exe	83
PID 1528 wrote to memory of 2192	1528	msedge.exe	83
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 2816	1528	msedge.exe	84
PID 1528 wrote to memory of 1716	1528	msedge.exe	85
PID 1528 wrote to memory of 1716	1528	msedge.exe	85
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86
PID 1528 wrote to memory of 876	1528	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\497498f7d6b7e1f40bcb1e52e33e91d8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbcab646f8,0x7ffbcab64708,0x7ffbcab64718
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3364 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2380 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5004 /prefetch:1
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2380 /prefetch:1
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2636 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5472 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1908 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,13544235807724594224,554342067506183901,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1832 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4996

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2036

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bafce9e4c53a0cb85310891b6b21791b

SHA1
5d70027cc137a7cbb38f5801b15fd97b05e89ee2

SHA256
71fb546b5d2210a56e90b448ee10120cd92c518c8f79fb960f01b918f89f2b00

SHA512
c0e4d3eccc0135ac92051539a18f64b8b8628cfe74e5b019d4f8e1dcbb51a9b49c486a1523885fe6be53da7118c013852e753c26a5490538c1e721fd0188836c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a499254d6b5d91f97eb7a86e5f8ca573

SHA1
03dbfebfec8c94a9c06f9b0cd81ebe0a2b8be3d1

SHA256
fb87b758c2b98989df851380293ff6786cb9a5cf2b3a384cec70d9f3eb064499

SHA512
d7adcc76d0470bcd68d7644de3c8d2b6d61df8485979a4752ceea3df4d85bd1c290f72b3d8d5c8d639d5a10afa48d80e457f76b44dd8107ac97eb80fd98c7b0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\6fd6de87-7087-4304-b3ad-32a48741a23a.tmp

Filesize
6KB

MD5
a9a44ebaa51365b28e175a385d3d9b8a

SHA1
852d58e29095c0546f9abfd5e8aa2f0485b72910

SHA256
8c09f1056886108e64cb202afb28c6df68f0d13e387bc59266ec35bc4269e8a2

SHA512
0bec1602975f08736374a70be3187b68cf8defd8845fe206b5aeb22e79c6e53250b3d94cda559ed9ba64106a23f50045d678b4ebe028c9b8105d539b236a0d04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
394B

MD5
9a02d6dbf6933d2364a562ac7680aa04

SHA1
2b2451369354d8ff32c39337bf0a7e73c4a09a54

SHA256
4f215536e631ea6b2c7b61949db72ae64132ca1fe2817709be4555afa620291c

SHA512
7ade5ca0f98f96b53c12f262265ea91c436df1b2ba919b054d4d099a6abd2765e0a57e34aeec4256d01fa6286b7dcd2f578f971a0e6e1d600d1aec1030a5b75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56e898abced6041f035dc0b9a0abb6e5

SHA1
1d46b62934ba23388c1291ac043df73964076fb6

SHA256
9777862399d0b2989293d11985db52f55b0c7bc8cb736bcabd34e6a919050e6b

SHA512
a8c18d7ddc2e03e5a12b154019316756369a88e43ae4bd7915f9ddebcd23100630828e618d90a13e5d0c0e51f850eedec41511e5c6693dfdecbf77cfef2d0b7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0cea0fbd25dcbde0b5c3d6a000cf1d06

SHA1
8b0bbfb43ae8c747a54b17a27ad7d6b3512cb873

SHA256
cecebc9740d40195a9cac2ef0d6c3be6e7f55ce2e39975a91cfea759811b291d

SHA512
f935b8c1ef5ddf1e29e1a4cc053428c307c90025f8d1300b063e8ce0b30ddd1cf0b9a155d9fd354fdcc9e373b9c19cd85fdd864cca970e984a20f3417ff24f7c

Download Submit