d7ee6c1442e6153e260dc92a48beed117c045ba5e21890acc0c22253bc992524

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 01:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad51481e1039fd5cbdbb2af001a9cbe9_JaffaCakes118.html
Size

23KB
MD5

ad51481e1039fd5cbdbb2af001a9cbe9
SHA1

60dcecd8f65ef1d5990912e787b5ff3f30d36583
SHA256

d7ee6c1442e6153e260dc92a48beed117c045ba5e21890acc0c22253bc992524
SHA512

e647c64abf839b6d828628adc4564897bd474569d2d4f498530019f0e853f6990f5463fc5c662d561898c6beea92fbfa6244e7aafcb8d19a77dabaa7488e6f48
SSDEEP

384:KITJ52sABXOeMN83LYEFkZHzM4K7FdWA4MPgbV+LeAy:KeJ52sSVVke4KRD4Moh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5072	msedge.exe
5072	msedge.exe
3756	msedge.exe
3756	msedge.exe
2616	identity_helper.exe
2616	identity_helper.exe
5304	msedge.exe
5304	msedge.exe
5304	msedge.exe
5304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe
3756	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3756 wrote to memory of 3092	3756	msedge.exe	86
PID 3756 wrote to memory of 3092	3756	msedge.exe	86
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 1904	3756	msedge.exe	87
PID 3756 wrote to memory of 5072	3756	msedge.exe	88
PID 3756 wrote to memory of 5072	3756	msedge.exe	88
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89
PID 3756 wrote to memory of 2932	3756	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ad51481e1039fd5cbdbb2af001a9cbe9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa62ab46f8,0x7ffa62ab4708,0x7ffa62ab4718
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2192,12586669672389298401,16473458376951727540,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
720B

MD5
1cd7bd70fa0edfa4dea2261c9dcae434

SHA1
d0aebd7cf9e0113e678ef5c0c24399e1c9fcdccc

SHA256
0bad3c6737e8e427d4bd1d942bb943953a391c25f68ebf36a71ec9eb0ad196d5

SHA512
db078606d07d9f5554fec6aae42f03264f30b25985488fbf4e57901ab893a65f7dcdf1146ae45f0d01a43060a118701ad634a2146192e953251c9fe990ad72d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8674c0a4ae7ebff1df79d83b02852161

SHA1
561bb030ced4b2d4b0c0bac7606affc3be62d59e

SHA256
fcb405288df5c7d748423b701588082f3a62211b1ad2af501ad9fec72c804e53

SHA512
823569007655c15b81b159d02d258b4b8a2d8e2aa9d2147e1d129a6fd991cd4e82ef6d930752328ae1713abd474b47fb2fcf86fe44fc7be1983d12d1eb2695c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5087c7d81b8c875ac255900789a2ecf6

SHA1
97d573151ff49cf80a3bd2f81b974958782e338d

SHA256
9e175109e85e8729c5e2ec452a86b1d9c17a2aef9f8a5f7cbb2cad19ba65e1cf

SHA512
69e2c8f5832d0fd1079eab0b2312ce2f67f29cabed8a25ee030a97c5e4000c8e99091707b5578caa6a944264588e58252e21263573ead11034b1d0e3c2f330ac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
41888a6c6ada42e37e82ade547d0a953

SHA1
249234636df727e5a737d8fd0c7ac5c600fd4b5e

SHA256
912fadb73c29e04ab92bad74f5387c7af26033dcc32731df488fb7031dcdcc0e

SHA512
2854f1ad9c4c459dd044577177d997473a50495d225e4f7c98d625347d4bb6568792fcab731026a8c68d7a9e01cf3c813cb2f4e2ec72b4ed7091a050935827b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
14c9502352113f1823676fd436bff1d6

SHA1
1f3a83decdc64f47f24814bd4e7cb586f7e5c4ca

SHA256
66672669815847e07a3bf0124a1c87205d1ff0dd43c562c8fbee046463d6d5b7

SHA512
33d265e16fbd5c4af40c6d6d018c2a60bfd50d660abed090bfe5957a41db32eee7d934c8612b9d5f77db5536c7e8e4978f9a83a3ce037cec5bc221a41775e775

Download Submit