a4f18d93fde9d1813e93ab3238263d76bf1078073ff4ff7126c09e96853120fc

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
04-10-2024 15:41

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

13f48dbbfac21c3dbf56253dcdae499f_JaffaCakes118.html
Size

51KB
MD5

13f48dbbfac21c3dbf56253dcdae499f
SHA1

f8471b2bcb6816f781f62ffbc4289bee4842342c
SHA256

a4f18d93fde9d1813e93ab3238263d76bf1078073ff4ff7126c09e96853120fc
SHA512

21152f5bdc9f83b1c06f9b886b828d3b84b892239b404e61db1e4cb401a6592e4f1dfbaa4220e5bd72ac378b56a0abf9a51f14af18e647ff893ca3d3bfd07007
SSDEEP

768:hgn13JcDxyHHHZyloSkObo+UqodVhNkerdS2ZGmYVtKW:yoDIHH5gO+UqodVhu2ZGmYzKW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1400	msedge.exe
1400	msedge.exe
5008	msedge.exe
5008	msedge.exe
1988	identity_helper.exe
1988	identity_helper.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe
5008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 404	5008	msedge.exe	82
PID 5008 wrote to memory of 404	5008	msedge.exe	82
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 4624	5008	msedge.exe	83
PID 5008 wrote to memory of 1400	5008	msedge.exe	84
PID 5008 wrote to memory of 1400	5008	msedge.exe	84
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85
PID 5008 wrote to memory of 1984	5008	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\13f48dbbfac21c3dbf56253dcdae499f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd83a46f8,0x7ffcd83a4708,0x7ffcd83a4718
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4772 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4872 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5064 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2052 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,4774157105079986982,847067372143707160,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5836 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
395B

MD5
3460156f40add9761dbba0fc482bf6ae

SHA1
fe0c591053dc19c9288af19961762386e5ac1177

SHA256
4c9d93c9e059ea0cbfef34a934ca4afb2413fa4e0d66da2b63a847b2b8307590

SHA512
f86cc0195a91ed2c7d661e3dbbff0534dbf26622ee20fb9ac4562ebcad96aa3d8bc0f6762b2cc311be0b9b15061355f40e34460a32248ad9ca0023369776f626

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
87a4d220fcfea8731674646b8c4ac1d5

SHA1
7171d9bec25b1fe2c92542d30f272a87a7cc1e71

SHA256
e7dd6240c171d86c5a16cc15488da6e70510caec2801aa3cdf8c9d55cbdf97ca

SHA512
30fff684219ece3872f72017d87339db4ecab2d86ddb3de77b66c968fcf9be57711c3501d9971b0275a820a7fe6ddb8e60d1e2004c98db64a759aeeb6115e5fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ca5d06f57aa7919d2f5c13733f4048df

SHA1
a9c2a67961d4171a30936d36b68c83da9a0bd3e8

SHA256
8af6c1ce9b4cb2e40c7f340a28cb4c270d7e459d0ccea339d4f06b54ad2baa18

SHA512
47f00723a36586b68919609425d48467fe7f6918cc3062bbdeea55a1ce8e87216091e4df716611b237ef7996d6afd73a9cfc2d0c792076de38b09cf092dba88a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ba8b4af8ff657a2d235ebc28b6893598

SHA1
b41c76680d67215d6a6a6e6b87453b1392ab72b2

SHA256
68d464cbed1c1f670e0ae54d66b8e38aa90ac33cc477acc43d3f7dcf8065770f

SHA512
f5b5ff40c58b27a75b9977d8da9dda538fc3d8e70df6d3630f98be3999c075f6fecf01fe90b550c1987afc44c1777f513196a63d6ed946ae20304dbe8f358097

Download Submit