591799927945e0fa1c593edb657e73e46d88500e3d284f5899820a9c3777f5c0

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 06:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

408dfb388d1e7c3d59ccc5c461608f03_JaffaCakes118.html
Size

175KB
MD5

408dfb388d1e7c3d59ccc5c461608f03
SHA1

a1292eb4b84c5c3d7f3176024f505e8d65485b51
SHA256

591799927945e0fa1c593edb657e73e46d88500e3d284f5899820a9c3777f5c0
SHA512

39d7bbd12a4566842e9f61511d0d8859c4055f23e53ad38caccea0343a8bb4ebf99ae260486595c7de702ba14e60f1b1678738cd00d22e1b6cf6f6de57781f53
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3tGNkFFYfBCJis7b+aeTH+WK/Lf1/hmnV+:SOoT3t/FwBCJirm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
4428	msedge.exe
4428	msedge.exe
544	identity_helper.exe
544	identity_helper.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe
4428	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4428 wrote to memory of 1200	4428	msedge.exe	83
PID 4428 wrote to memory of 1200	4428	msedge.exe	83
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 3548	4428	msedge.exe	87
PID 4428 wrote to memory of 1784	4428	msedge.exe	88
PID 4428 wrote to memory of 1784	4428	msedge.exe	88
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89
PID 4428 wrote to memory of 4992	4428	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\408dfb388d1e7c3d59ccc5c461608f03_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0ddf46f8,0x7ffc0ddf4708,0x7ffc0ddf4718
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2088 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4708 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5904 /prefetch:1
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1940,1286295250847894023,15563128449701582324,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5584 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3384

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
c695d64d85df9b6fac4ca47955594621

SHA1
98bf3d850782d5d86f9d0638d19bbd2eca8bcdac

SHA256
37a4e2a8bb5a740bbd0eecda26e431d59517936859b977d05f80636c01464665

SHA512
4ac27d6d217ac9fa6d16c90d9331d502da3daf067e3e9ba26828924479871430b3a4055bd7e78a2a8af4c3fd10982c1209dc6d13dc70335f9220d6c4e7085bfa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
597b14a1c7cfed4fd6ce7c9307455dde

SHA1
82563db13e4b95256b4f8e0ca3f260964a50740e

SHA256
dc26255df9a1aebf17c7f3353410d7f84cd33257be46a02fdc2f001f6429a802

SHA512
94d0022efbce6f35bf251a1bb69a5c2a78cd48ffbebc3e007fcd48c7219c84ef25adeb97fe5dd1fb52c3765805674c32e2dcccdb90882df94d5e3411b50e837d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
55be9fad9ab1b80c51ceb5a5e6529554

SHA1
8b21bcdca0632770cee8abeb5a21376b6ba35904

SHA256
a58e2bcd3e7f6476d6251487b34797ff275750d6f6237b0696e76d951f0a9795

SHA512
781feade353e6f7b83d97cb33219579e13443438a39677d918150ffd75f350c3a12f2bff5b0f32103a5db291fe30c3b4c2702558ff12efe0ea44c21b27ff8d83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6f3ce44a388fd3c62deb2f397475fa5e

SHA1
7e05f5666d344d72077c8c22bb1a717c101ecc87

SHA256
c5281d187cd33f3ac339bb586754625b92aabbf668ec6d5075a9b3d4ca640adc

SHA512
1e203ba9008cbca5334892c7008766e2c40b0410c62751debc4c07fce3a1fb6b5e07cc6e0485071036479442a36a3ffad348ec84806a23c6e64c5b11808e2e53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a6d12106fade22daa76f3237140da9d9

SHA1
1b5ed7d3f0e6fd04662dc43c29f7a08a835175e9

SHA256
a2ec6039960706849ee2bf5a3b0e51fcf2c3b362883edbfad929c048b63175af

SHA512
e905f3021b3c6ebb8e3abbfb0984ffb2264f1043e5dc162cee327df3303f9a4b47abd6c041c6945cbf65c6a5069ce7aaa5dcfae4747c4d24b67feefbf2b22db6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5bfa6427acf5a9e8b54d4f409c731401

SHA1
25da4652815c53a7569b99a5105c562622172d94

SHA256
ff49703099872eed4b2cec45b63d7cc1c49438cf5dcb02827ac2f9de4b672254

SHA512
e8a9d776474a4684ce8772e0cc1b0fe505c3d97e07119ca9f6b6b964e3609aa77093ed4ec31bd91305ee947d3673bc0b04085a441a708d60013b7a3930f9bea3

Download Submit