e5adbd896e6798b239b72f101a5d462fa9057bf5ae742ed4b73552950506981d

Analysis

max time kernel
138s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
05/10/2024, 06:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

168c8efecaad887931e0ea3c47474f95_JaffaCakes118.exe
Size

388KB
MD5

168c8efecaad887931e0ea3c47474f95
SHA1

d8d987e83624d6251175adcf429e04f7a9818b3c
SHA256

e5adbd896e6798b239b72f101a5d462fa9057bf5ae742ed4b73552950506981d
SHA512

38e1c3d63b9265f2a8195f24a5c56f7b5d8b583abf6291f288841c7c7dc3dc9b1b38d508020cf3281ad0ad01ac320cd5db4677902eb769ee067701ba7bd95424
SSDEEP

6144:PE3EM9rHuTnTlVjffbYhOb9jBz9ySIVUKjFFqLEATwigTkVnK+Iy:PE3EM9rHsYWjBzHwFcbEKn0y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	168c8efecaad887931e0ea3c47474f95_JaffaCakes118.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3864	msedge.exe
3864	msedge.exe
4548	msedge.exe
4548	msedge.exe
4564	identity_helper.exe
4564	identity_helper.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe
4548	msedge.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
4680	168c8efecaad887931e0ea3c47474f95_JaffaCakes118.exe
4680	168c8efecaad887931e0ea3c47474f95_JaffaCakes118.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4680 wrote to memory of 4548	4680	168c8efecaad887931e0ea3c47474f95_JaffaCakes118.exe	85
PID 4680 wrote to memory of 4548	4680	168c8efecaad887931e0ea3c47474f95_JaffaCakes118.exe	85
PID 4548 wrote to memory of 3992	4548	msedge.exe	86
PID 4548 wrote to memory of 3992	4548	msedge.exe	86
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 1908	4548	msedge.exe	87
PID 4548 wrote to memory of 3864	4548	msedge.exe	88
PID 4548 wrote to memory of 3864	4548	msedge.exe	88
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89
PID 4548 wrote to memory of 5064	4548	msedge.exe	89

C:\Users\Admin\AppData\Local\Temp\168c8efecaad887931e0ea3c47474f95_JaffaCakes118.exe
"C:\Users\Admin\AppData\Local\Temp\168c8efecaad887931e0ea3c47474f95_JaffaCakes118.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://www.omg.com.tw/download/download.aspx
  2⤵
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:4548
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbe59946f8,0x7ffbe5994708,0x7ffbe5994718
    3⤵
    PID:3992
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2084 /prefetch:2
    3⤵
    PID:1908
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2828 /prefetch:8
    3⤵
    PID:5064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
    3⤵
    PID:3604
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
    3⤵
    PID:1840
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
    3⤵
    PID:4636
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3888 /prefetch:8
    3⤵
    PID:3380
- - C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3888 /prefetch:8
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:4564
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5380 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
    3⤵
    PID:3856
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4084 /prefetch:1
    3⤵
    PID:4772
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4804 /prefetch:1
    3⤵
    PID:380
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,9718797705721767317,3469459264036559440,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1748 /prefetch:2
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:1672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4820

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3308

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
709c6f4a32b317f6487b598788b6353d

SHA1
50f44d43be9630018f0bd2acb1528df07cd05b7f

SHA256
353aff71e8cf078c88c836e66d86be266ddbe36496a597b9b5a5a87d21eae83b

SHA512
4f33792eb73a792c88e8e2dc8bef7b00a2af7b1b91f4bab0cd5076dd2cb9abbb752eb7e60a4c6204d15f9bca1562915f2468b94e5f01f79279e1e7469055f0a3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9ebc024cdb324eb41f33c6ec63d1458d

SHA1
f623e96981ee63c1b6879f682c4364fd5c2265e5

SHA256
23b9bd7316816043f42a80784e7f247f3afebd3dbe370fbc702189a6a0dddb1f

SHA512
6971b6430bc01a36c48bc1e41cf8c4bed65a2890837f7778a896072159940ae739d11834176cc7be6cf6fa0f2ea9e6764c30cd23beadcc88c390e5573bbad097

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
6b2506c2137a51e5e20b71449c2b122a

SHA1
e27686b66ee2802306749e252246f314c2e7a8f2

SHA256
618b6b88bee60c7e0551b9be9b04456e067f8bd591b6cf94144de5c0491a692f

SHA512
44bd535dd6f0201752887f23293d916152943d416a285840b7d87aa0bff7deda202b9aad5ca360d70f73b658e06d85619b2a47abbd3d5c51c52730356aae3875

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b74f7e450a22a7e42e99bf3a52627d09

SHA1
fa0b3c2c9ad0e67cc210868994cbb7e72f5a411b

SHA256
0b921022b1dfe1b5fc54f306e33c407723dbaff12df4369c7d684c42404f95e2

SHA512
0553a4a5b59ad522ed6f294ade87233203ece5b79dc9f3837aa200498da7b7b555c7b1a116ed6c161b1eb23344b522283b2318f2914c97d676650ecbe2ce7066

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6d133caa8632ac7a848e6a2169847390

SHA1
b54630d5f6aee61f87bb6ab6ab889c140b6f5669

SHA256
f3f6567d95147606dab9df0527f66084968032ba7cd7558869312dd5ffbdc28c

SHA512
06c54b2c438b5f8ac8d7cccecc83bf377431be6b5c70cead1d7b24d6c89109791631ce7f77d7d0ae0b3e9ef3423855fbbd39baf93e86b0e53f20eec35ab49331

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e9aaa893bc2455352c12ae6f44899b9e

SHA1
7fc9ea6ce40a2dae0cb3dfe91d679190d30ef2b9

SHA256
d3f70a96f21a60279a9683c196e196305c330ced2d9027293a10b99af9ddc4b3

SHA512
dc639f630a46e155f0681a3ed26e64655ab75e051562df73d992ed781dd6aba91e2bffa74bf59281bc6cf58a7caffc6877295cc8d595fb1687d46c4ec5386fd1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
494a861dfe3fb61b7f6e9a8e1f92d179

SHA1
903db9c91a888cdd2a359e921ea2c1a958228aa9

SHA256
46ffd9cec0b1524402f64218ea9584cb751cd61e56eae54ac0ad61c55273c690

SHA512
f97bfb87546ee38f100ef52f6ee6d102d05feb378a940954a1953f5dc301e6ae7a91de2b2176dcac165a61abf867e06e3e31572a378b1abd9ea2768de76e7175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f6f9ee257ac640f1ca5949b2032ccc7d

SHA1
7b396cae6c197e0c5030f7431bbc24991ec716b9

SHA256
bffb7e55dc61e7e6dc74efce6e08f086fab83b5ae1d5ff9487f610d6dfeb00bf

SHA512
0c52485cf5dc68e73eaa24cffaaa8fd65a006c82a2bb1e3ede7909fd6fee676a96ec912391b1a4cc466d9218b05a82dd1fdc4eaea1154768624aaba11ffac08a

Download Submit