9413c2f62abd34029f4c49b0fb514d7ab194e7a9a1ba95eedbdd01d326c9fa4a

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/08/2024, 17:30

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b45f629926aa99711dd1188d2f49ea67_JaffaCakes118.exe
Size

1.3MB
MD5

b45f629926aa99711dd1188d2f49ea67
SHA1

b95d5a12f825cce4048a3b418ceb7e17416b139e
SHA256

9413c2f62abd34029f4c49b0fb514d7ab194e7a9a1ba95eedbdd01d326c9fa4a
SHA512

f012399767ded6ee10d98a4d93c3a2e8d8a6c69e8a66d7eac60041e236083534a86c453c383b52bf17c3a2558cfbcdfc7b5a0a5bae3a9d435c509ead68b104f6
SSDEEP

24576:cejDKKiDkY2+AhEcy1BirYZqXMrDjUm84QeP3Cqkkkkkkk/:ceUDeyLZqcn3Cl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b45f629926aa99711dd1188d2f49ea67_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2704	msedge.exe
2704	msedge.exe
2960	msedge.exe
2960	msedge.exe
4368	identity_helper.exe
4368	identity_helper.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe
2960	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4784 wrote to memory of 2960	4784	b45f629926aa99711dd1188d2f49ea67_JaffaCakes118.exe	86
PID 4784 wrote to memory of 2960	4784	b45f629926aa99711dd1188d2f49ea67_JaffaCakes118.exe	86
PID 2960 wrote to memory of 3124	2960	msedge.exe	87
PID 2960 wrote to memory of 3124	2960	msedge.exe	87
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 3772	2960	msedge.exe	89
PID 2960 wrote to memory of 2704	2960	msedge.exe	90
PID 2960 wrote to memory of 2704	2960	msedge.exe	90
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91
PID 2960 wrote to memory of 2712	2960	msedge.exe	91

C:\Users\Admin\AppData\Local\Temp\b45f629926aa99711dd1188d2f49ea67_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\b45f629926aa99711dd1188d2f49ea67_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://makeasymoneyx.com/redir42.html
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:2960
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc28ee46f8,0x7ffc28ee4708,0x7ffc28ee4718
    3⤵
    PID:3124
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
    3⤵
    PID:3772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2884 /prefetch:8
    3⤵
    PID:2712
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
    3⤵
    PID:2060
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
    3⤵
    PID:4276
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
    3⤵
    PID:3792
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
    3⤵
    PID:4412
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    PID:1376
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5528 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4368
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
    3⤵
    PID:3568
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5596 /prefetch:1
    3⤵
    PID:4560
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
    3⤵
    PID:4768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
    3⤵
    PID:2916
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11175994776894493395,865352423137594751,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5992 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4252

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4664

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
209KB

MD5
3e552d017d45f8fd93b94cfc86f842f2

SHA1
dbeebe83854328e2575ff67259e3fb6704b17a47

SHA256
27d9c4613df7a3c04da0b79c13217aa69992b441acb7e44bf2a7578ca87d97d6

SHA512
e616436f2f15615429c7c5c37de3990c3e86c5e1da7d75a0f524fc458b75d44a5be1a3648a628d63e1cf8aa062e08b538f2f2bc9c6a0b42157beb24f82c571d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
6e44906d89e55579eeab5ca01b531eb1

SHA1
102d407261c04bd7bed3fb0431147e32bce85af9

SHA256
27cfa2d9d4b3eb0c68df84a3543646b5d269fe08bbb7036c72307772a5ce677b

SHA512
be970ee4469cd70364185c922c5166ef358185c0cde42ed1410c5c2e783fbae2eb6aef9cdbc8f76ed593bff43ef0efe72ecf5b1e299a5fe2924c4abe8a5ce189

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
65c3b7648fef387f5897dd4bad8ab9cf

SHA1
6db4c0559c3a66a445dd64e240d28ce191aab89f

SHA256
8f77118e3fadb13af46b34bfe9ec4825fae1b2d9ab6e059c33deff8363d28e95

SHA512
6611a9ef95293710c4d135d9fabafaccfca1e777535cbd53b2e824c467eff33fa880d0bf65f5502239c2030950d7ea8c775446b888d28c35783835fdc749d2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6966aea59090a6539fa551c5433b228d

SHA1
32b3f603db6f3c1a88428c3a107fbca9e68c94c7

SHA256
e2b355aa10723853b6aaf10b1143cdfc0dbf4ce5f46a398b20a63d7cfe3f5d69

SHA512
2e2e19d85dd683ad399a3d8c168c54903da4fe505630b8fb53b99f782313865693c1c75791d628bc74afdb45d7f2eae4caaeefc7e30cb96d1bf1dedad76ef675

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
377b5042c048647fe2db82b2be4ed60c

SHA1
20fd89ccd0b7bbcc959a52057351ed452af829da

SHA256
154b639dd570561834d12b915a717056f3266bd111e466b458b51ce2462310e1

SHA512
c92ba8385b267651f9b80dd919bd2b20f0e00c8dbeb978783b1a5b772fd9033f755598f4f89bd4cb7901828a509a5fed9aea9c710c398e9cb4debc7a1752ef59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e2e34511a11c6c4c0249cfb0ba8519d

SHA1
a8c17b6dfddfb03168eeeaa89e4eb0ec999f079e

SHA256
659e2d23837bd1eb932c03d967247576f0d3ee600ec611e8f61b7cdd17c4aa2b

SHA512
199ffcfcce04b8d3e9c3f51865c51ce9496fef932ea646ccdaf0a856e1a54759f5a194c0ea6291681335469dd4f7b59b75d33e8163a425ccf6afd88f4635b2eb

Download Submit