751c88e53a7e73f513c27934f0406688da00fb410ae923e95be0605ceb2d388e

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 07:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c873518c5261d6633a45b958f12b87e8_JaffaCakes118.html
Size

27KB
MD5

c873518c5261d6633a45b958f12b87e8
SHA1

fb7acba258a0998893ab00ff1c5d3e0db1a42b30
SHA256

751c88e53a7e73f513c27934f0406688da00fb410ae923e95be0605ceb2d388e
SHA512

a76a2b0dc7cb54e452ad7a5f509bb2b067cc4e3be2f288d47f1fba2adac3f932cc6cd19b4f41af6e998d7bb0d0029528598537181493ccc9ad02e23d5039cf07
SSDEEP

384:4sA1H1LXoHiKEiPORgN7d61t0MPdiFdiqAZeRcLIlBIVMmifiRV:Y1H1LXdyPORgN7d6cqZslBIVM3an

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
756	msedge.exe
756	msedge.exe
4304	msedge.exe
4304	msedge.exe
2700	identity_helper.exe
2700	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4016	4304	msedge.exe	84
PID 4304 wrote to memory of 4016	4304	msedge.exe	84
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 3688	4304	msedge.exe	85
PID 4304 wrote to memory of 756	4304	msedge.exe	86
PID 4304 wrote to memory of 756	4304	msedge.exe	86
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87
PID 4304 wrote to memory of 3016	4304	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c873518c5261d6633a45b958f12b87e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb53e546f8,0x7ffb53e54708,0x7ffb53e54718
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4588 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,8645597559537786102,14993807950821428024,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8c7288c0c19e1a313c8db679b85e8fd0

SHA1
fa6d6379ea61718b52ce245d2467949a80d12042

SHA256
4ab4c0142f9d0e4d3a9aaf16aa42b72b2b76f31d2448e6258290096f637b3d45

SHA512
4380a1d005f76714d9a79c3fec443b6600569b31d638a17a3ad49988642d54ff58f52e919e3cd988b66c707e95f458e09acccb19ddf36ef21d8d7a991b481f71

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3a6d9a78fd21b07f25154511af8fe08c

SHA1
a352934749862a52cc299ccbaa8ecae194fdef8e

SHA256
71aa40de92374992344859d8db6e295b1f4f981ed760c60960fe40db52fd87fc

SHA512
dbcd545816807967b1786e3e73564a886db7887c792207ff36d69481f8322c1343129c6a9120961d3c75406ea047cc2b8a3c9f6d8dc3d73f4df39bc6a5f5f21e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c55f3954811128e8dc811ce84856621

SHA1
040d63b747a7ae622e0b27dd13b2b01fb9bd1ac2

SHA256
5ebb3c14d04f6cacd693a408382d8b619693ef80f8902a80d90c366c0d9aa3d7

SHA512
e0e9145272038efba3b6317afc33f164a9355c641fb243244a727cca789fc2c37ab4591dcb1194d86992e1ff726d900378813b1b954021de7157d11aeaf3763e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0c70961fd5fed0d398441208977fe20d

SHA1
0beb506d226023c88c841c257c5af8b56ae32eb8

SHA256
a04c2e15f1c476869ee6f31db47f8c4c3f7ef203005fcf430e9d175b2874fe3d

SHA512
f69c8cc5b9da54a0c4f5ef835aa06e4e03a5026fcd52ac9a84d7f8875effc053a93a37c09f4b1ffe909899a34860c73968c68428890ce87e0c0a1886e747397d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
874B

MD5
2deee3d4a148d678ab81b849413d6da3

SHA1
9cfba21b2db914b0de288345fb7ddc312a56103d

SHA256
abcf1280d19b0bbda13bf2ce4c0e698212255c31ddb7dde237cd190484de8d78

SHA512
37a67243d0372876072d4b9a8826bcf7e57a68d87b65aad9fac8989908220b24ccb87280a9a01a4599d27c6f274bab9a34dad2ed734a87a3c2d6514e0a9de5db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe58368c.TMP

Filesize
204B

MD5
9c01678f888fc459985e0fa6e5b85053

SHA1
51953a2be93b8203e9c8692037079942070e3ae3

SHA256
9d59347cabd1cd45d8c37409638ebcae265b5b77b0318268ea414fd25d685f4d

SHA512
6f6b5ae5aed36b36744598555791f2f2c5fc31864c32078c2dfe6ae622eedaa0ece8ec81f566fe1cea2e9d89cf09d4eae7316075b72af28f62e49e72b5f68801

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
463747035dbfe7061391c896b228abb1

SHA1
59fc8df2270a4a3ee3cc64d3085e386b54f8214c

SHA256
3b505325874889b03fa6a8766ef8ee50c99671bc4a277e8256ac228073adc4e2

SHA512
c31644ea1976feae3550d1fe0497b6100f1b7bc3de5343b0432fd25e1f0728ea07e9d81b131c81dcb6f68ff5e95b627dd9fdb8a43d0bf5adda65e93c2ae75c39

Download Submit