416bdf5ed35eabd7473d842b5c0d9899a6d5fb7e4ce461445925af3296157d10

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 03:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fb73fb2a674619797967a30747dac82d_JaffaCakes118.html
Size

52KB
MD5

fb73fb2a674619797967a30747dac82d
SHA1

14ae9321c805f0d7dcb931c221f965c3bc457ce7
SHA256

416bdf5ed35eabd7473d842b5c0d9899a6d5fb7e4ce461445925af3296157d10
SHA512

4f77074b45393d691129e1eb7f1117f2a6e8a8382ed2464e145b6849b7854355af9176d3ab928b6da6bb19a2d464a09a3f20fadd2d2ea227769264d9b7080786
SSDEEP

768:H1T0EipBj9gtBoKgOEqHFNfBDoAWTcsjqDyB6x62eS4t/j1OCiqQu4:VTupBj9gtBsAWTcsjPB92eScjW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1700	msedge.exe
1700	msedge.exe
3140	msedge.exe
3140	msedge.exe
388	identity_helper.exe
388	identity_helper.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe
3140	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 3608	3140	msedge.exe	82
PID 3140 wrote to memory of 3608	3140	msedge.exe	82
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 4196	3140	msedge.exe	83
PID 3140 wrote to memory of 1700	3140	msedge.exe	84
PID 3140 wrote to memory of 1700	3140	msedge.exe	84
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85
PID 3140 wrote to memory of 1840	3140	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fb73fb2a674619797967a30747dac82d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff77ca46f8,0x7fff77ca4708,0x7fff77ca4718
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4352 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:2248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5952 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2164,3434065881055950271,8658166412806455841,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3456

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
14677c8f608ca238dd1372418e6bf490

SHA1
025a2ca83fa8bfdadf3e3be8cd1b917717681516

SHA256
79b3202dd539aa21c0773a20bccd05acbe653304883cd29ba9ab61bf636e4de6

SHA512
64415a55ecef5c6983d368baf1420f8f6eaf51b778e77d796d3e7b0f1f6ae5f6f5b71515246a27def0fb103c817e8cc72b6cbd95fd4bd0063c4a6ac97e5dadcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6ce0dc1d0d11176f15dee00703ff65f3

SHA1
e5fe218069f2c05771c6b57e4ebd8e6ac76cf5dc

SHA256
27a0f5b7e025aee40930d7958151d9fcbd0337c9bc302fc70125dda84d102212

SHA512
179a23ec796ef7a6d6e93e1d76c654bad853803806825b5f858b6ff0c312d923a2e2cfaab0a4b85bb4a9b90ad26e9ff3c5b1d01fa49a3d4c3bfaa60f478fb4b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
87a96a961cb33073d6e9c41541ae9569

SHA1
560b6bfb8a954291dc2f3596ffd196958f372c2a

SHA256
e27b5167a358d501a5ea1b098bfae703841072e804662df52c47ccf825a81773

SHA512
e22509295ae4bbeba7bb8cc32d36d2e128bf445fc4123bf8cb2e4713ce98abf22c336598d7bafe66668bd37dc06f81875ca3b6edffb766430eb0c3f8206ae3ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
93612b8f835f78dd5cf3230f577bc975

SHA1
434763680bb5dc0b6c90a0b1dbda1bb91e455c7e

SHA256
d544a548bb31ea243f1f953ab90b3b64ee92cb00827c6816252d7e8d8fc5950b

SHA512
b398f4ae8acd9156017cc96aa024cc4b88381f1ec46bfadc7794dbc5e9029955b3450dc835ca7056c6f0d97245285c95c45b79e1a7c61414752ce14ecaebc14a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e6bf559a5a1569ec2bb716fd11f466d8

SHA1
aae598df4f6a68c3d34ec50d0dd1f97e81010422

SHA256
960074f5493ec257cdba9c3b6fa63216e7b00364889fdda49aba9ca199355876

SHA512
2ad070c5a68ed7804cdd16a7ded578b3dff6cd0ff7403dec15df7c07468e4ebcc3ee937282d6c47a0ab9011856d323d50f5f0ada1bfb6ad1e113ee8490509e2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e273bba8cb3194446bbfaba21c89195a

SHA1
addf4ebd6eae0d56807a42834cb2cd9059ab00a1

SHA256
a4d79805438f462ac4afe376660a458c128d21c462aa840b7f7c64c4b2ff7d61

SHA512
5632a644a3b095e0f14b4612ab033611053b740390203a1bb9770f5d2f1320ea4e99f390f6f37b6e47bf40732c8ba04fc816ba841afd49fa2ca2b33d4dd4f48d

Download Submit