31ec1bf3055f348ef37f14d619c747ff6466f0dbf43667fd2a955265b62a20f7

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 01:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

287d04d8ae43012ac13fc3c843082064_JaffaCakes118.html
Size

26KB
MD5

287d04d8ae43012ac13fc3c843082064
SHA1

0e18275d0ad3565f6cc47fbdf9cb3b0d2644d9cf
SHA256

31ec1bf3055f348ef37f14d619c747ff6466f0dbf43667fd2a955265b62a20f7
SHA512

19a206963cc007d5a6bab836a32dd810d35d6026ba48bd3cd226e3b96cc649a5297dd7b536a697e9e86a7f1260b61d222f935f44ea308decf3799d95a53876c9
SSDEEP

768:3kdlShcT++HYCRy7kceGyS4fm/E9YzGvJa+G:3kdlSyT++HYJkceGy/mE9YzGvJa+G

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1780	msedge.exe
1780	msedge.exe
1476	msedge.exe
1476	msedge.exe
4772	identity_helper.exe
4772	identity_helper.exe
4772	identity_helper.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe
1476	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1476 wrote to memory of 2600	1476	msedge.exe	83
PID 1476 wrote to memory of 2600	1476	msedge.exe	83
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 4464	1476	msedge.exe	84
PID 1476 wrote to memory of 1780	1476	msedge.exe	85
PID 1476 wrote to memory of 1780	1476	msedge.exe	85
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86
PID 1476 wrote to memory of 4832	1476	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\287d04d8ae43012ac13fc3c843082064_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe3d8746f8,0x7ffe3d874708,0x7ffe3d874718
  2⤵
  PID:2600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3092 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,7483213353222117013,12798061360938927698,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5252 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4488

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
bffcefacce25cd03f3d5c9446ddb903d

SHA1
8923f84aa86db316d2f5c122fe3874bbe26f3bab

SHA256
23e7cbbf64c81122c3cb30a0933c10a320e254447771737a326ce37a0694d405

SHA512
761dae5315b35ec0b2fe68019881397f5d2eadba3963aba79a89f8953a0cd705012d7faf3a204a5f36008926b9f614980e333351596b06ce7058d744345ce2e7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d22073dea53e79d9b824f27ac5e9813e

SHA1
6d8a7281241248431a1571e6ddc55798b01fa961

SHA256
86713962c3bb287964678b148ee08ea83fb83483dff8be91c8a6085ca560b2a6

SHA512
97152091ee24b6e713b8ec8123cb62511f8a7e8a6c6c3f2f6727d0a60497be28814613b476009b853575d4931e5df950e28a41afbf6707cb672206f1219c4413

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
dbdcb985a075682129973785140bfda5

SHA1
f2afdc4f649cfee3811ccc3b45729e76804cd949

SHA256
be2e164084439a1f63108c2e29c81dd768819e9586d59e239f2146030a2bb3c7

SHA512
91ea00b63d07cf1b68806fd9f8bf934eb6970318eb5b72608f8cda4b0c0caa9da377008f6ccdb9b2e99c690a086749ce42a9e2198a98d159bc750e174d8832f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1a21a49d49b7319372c6c9771cb00038

SHA1
2385e3294cf0bd22dbfa21033285025420eb8c85

SHA256
1e15c871c5f54f8ce3b9af9cc65e721572b2920a1055d85ba1af7f82e9d043fb

SHA512
1230b5c26aa9e50df7815d66064811a582ff19d4d4abca4da30bd6381f81992fec7220702e158f2416f5aaa7b89a9576cd13cf68cb54a532050b931c01e118fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b678a564ea76ad456a93c5a2c64fcca3

SHA1
a061eb3ecb440c33d26e7f69075f5138ff5ec06d

SHA256
04df21d1d1e3815fb3f268c18208b40dde84f9d10e3713eaafc9088e2cd00623

SHA512
934775f685ba43a5d2049348f393f924e0809e9597668be5e615c93e3c22077fe39ff16b64583adc4dc2c44b8464b7b958235d43df08eed44c7e5ce25986ec3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9268661f12f61dc380790ef902da710c

SHA1
6c430da9735ece50e01770c80f3bcfe14c6fa502

SHA256
054bb23e65f7015ced7c4c55a1e813e97d953637b66b2e0e8c6a47dda03966ac

SHA512
f5325dba69e933555e2278e7476b434a8c10b37540f4b1dbd36e6adc7da0a914a4191e42023a7e0f94f23806d31ffb1291e1b82012b9f6ae22fd3827425451da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
35c1c6a2c092c36142c52412a34e592f

SHA1
37169fe7d3e1d43c1c701e53f61bd185619747e1

SHA256
42b3faae6a7f5c6ba5a6875852bac2a809c77f6bccab34537c616bfd12e95db2

SHA512
462139c5d03e060a7b4589175cefba298d5ee3e0f52c46303caa25d903ca3707fdc371177f460fa3665e8e331c9d5556eb5a1895178e0dc8a82527da266350c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
1e6be69d2179b4db53e8dca31d549438

SHA1
0e1d4d43e30b39f994d3f001eb93861fb0b1b0fb

SHA256
075781407f05673385b69200a5420c6a1bb6db167027510cb200c7e7de798d32

SHA512
11520569f47128aa0f1484d2e9738d4b04e8397e1e193a871937a4c300d982063a95b5b7282d15ea1a3445bff10a374a29f5fbb587fb71f3f17b0dc316492faa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a819e57762f28bd576d7f05f5dc051ad

SHA1
e5a26ad29f300a958b34a918a839089f714251f1

SHA256
a4d738a2ef2286e66d8d805e59a4a73a97f5e5e8d1ceb0d4c7a4e8105def1000

SHA512
f98e1493cdecc8c21dd5787b39a94a72ba548fa880f66ffb810870822f2a134b6fde00341370b9331a615a6f0c45c3abec0e648d731e24932628c9a2dfe88c43

Download Submit