4567260581d6f9aaed54571e6a3697763f246f49aa67e816cef8ca7dfceaf5d2

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 16:40

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fcb6b84ae4b1ef86744dd06e48bfcdbb_JaffaCakes118.html
Size

175KB
MD5

fcb6b84ae4b1ef86744dd06e48bfcdbb
SHA1

6894b3a0c68e6f322d36c3edf5106800c6207410
SHA256

4567260581d6f9aaed54571e6a3697763f246f49aa67e816cef8ca7dfceaf5d2
SHA512

a17c3568f9afd844fa713e274e1c09f1f679c7a389e20b9f92cd120bdf039c4a665df4d6b5952f106fa28974f0009a1c02db382e10b05faaf247186ad46c528b
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3MGNkFmYfBCJiZe+aeTH+WK/Lf1/hpnVSV:SHCT3M/FvBCJi1B

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1756	msedge.exe
1756	msedge.exe
1008	msedge.exe
1008	msedge.exe
620	identity_helper.exe
620	identity_helper.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe
2920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe
1008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1008 wrote to memory of 2136	1008	msedge.exe	82
PID 1008 wrote to memory of 2136	1008	msedge.exe	82
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 4688	1008	msedge.exe	83
PID 1008 wrote to memory of 1756	1008	msedge.exe	84
PID 1008 wrote to memory of 1756	1008	msedge.exe	84
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85
PID 1008 wrote to memory of 3308	1008	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fcb6b84ae4b1ef86744dd06e48bfcdbb_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcfff146f8,0x7ffcfff14708,0x7ffcfff14718
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4852 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5712 /prefetch:1
  2⤵
  PID:1244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,2728196147688030166,14997369048115950227,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48126c84-dac7-4238-b8e0-7fc2e6c33f8a.tmp

Filesize
7KB

MD5
df6abc5ead8138bd0185666b5c6b3b8b

SHA1
db052111d15049b99b8bcc803f05235505b7b5db

SHA256
dc131085db8c0e10585e000eb716f42f7690708606f3085e59b3a7e8c90896d7

SHA512
2d3ca0bcc7164c53cefb89ef2391246cb0645132dfa25905cb81b102238b05587c9e3ef8456ac055d871ba57724ca2d040072ab2e40a44fcadb3c191591a035c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
532cfb793e85749fc6b1ea3aa1d62ed1

SHA1
c77e9bec664bec1957c00788b8c2015f4f15190b

SHA256
1bcd2aaad06344c16d540e5121474f9e1c803ec90f68e7f863e9e4f7ea09c9d6

SHA512
9b1d71975ead6013913509db33b887df4690335ee2adce588fe84a578183f140387feec25ceb3fd583bc71f162b2e5441f9d5707c4411cc44147763bc3e8deeb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d9aa490e285c2d6c3ecd4c4a02176a37

SHA1
f0e1b4f91840f9856e0ab4978918b3ce026b71c3

SHA256
6bae407dec775cd61b112bb94f991f97c1f432683be965b63f0f690f486f307e

SHA512
a80a2537890df9dba4097fa202a866dc12512b1b9a78b9b9e5098f5ab266013c734700a60020a97c08c9568a57272277bce0f4d794fc35fc77beff4cc7b60f7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
73dfadb8094c738e2ddaa7873fc638d7

SHA1
aa666dc683d71a4122f565131ffba481107383d5

SHA256
5baa1bdfff2361099a249857b950cbdc4045d77741bbd8ddfe9d41cdfdcc7443

SHA512
808cce241fdcaf834ed71195c605787dd90202fd6536771eb17fb5e93cd4e4a6aa54adaf4ad2b6ca4ea4aee7035a13e12b9879fd7655201ed21e6eb67f744f5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
89581915b1591e0d07bb76565e1ff62f

SHA1
65f2e0307c3f3d91341d90c612f3dbf1e9e3f1e7

SHA256
420b15767f5fab2a0b38d2e84cfc443d5c270cf5063e9fd79a8da1aae262b3f9

SHA512
e1baba79d8713fb41408c085eedce16465f3dcd1d28bcb728275cdd9d2a14f0027db2e8a52347474e50edbc16b2c6ec338d8d0f8611f3f90590496b4c5bb3478

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1f9a5435e87e520193cf8b28e1f62a55

SHA1
0797c77d9a228f4c8fcf5b7b467df1fcb08c5acd

SHA256
a533359a7a2e49091ea1bf0bd3e3aec633ff311525e8ed6f052382fc606353b5

SHA512
cf37c512ba374f7a7ac3ea95056c133fe05c0d69d9341437931c50cfae894d5a246d85cfdf37df9fb2189ccfb93a0152317ad608167899f8a1b861103536a99c

Download Submit