ca76bb26237e77ec5a04f082503d9a7ec6eb370a951da67b2f24162a95c04697

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
28-05-2024 05:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bcfd83cd1a52c6ca92ea9dbf62e7849_JaffaCakes118.html
Size

175KB
MD5

7bcfd83cd1a52c6ca92ea9dbf62e7849
SHA1

8301186f31e991fdc9cdb070034c3f058599e9c0
SHA256

ca76bb26237e77ec5a04f082503d9a7ec6eb370a951da67b2f24162a95c04697
SHA512

4eabdda5c68b4ce4f76d594218b73c405f120ceeb65cae67b389904b992385288d1b856a0d9309ebcc1b7e7b110f68b2c952413b8a3d834ac945f613ee959a51
SSDEEP

1536:Sqtd8hd8Wu8pI8Cd8hd8dQg0H//3oS3zGNkF3YfBCJisd+aeTH+WK/Lf1/hmnVSV:S4oT3z/FGBCJiJm

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
4896	msedge.exe
4896	msedge.exe
2532	identity_helper.exe
2532	identity_helper.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe
4896	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 5780	4896	msedge.exe	83
PID 4896 wrote to memory of 5780	4896	msedge.exe	83
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 5060	4896	msedge.exe	84
PID 4896 wrote to memory of 1156	4896	msedge.exe	85
PID 4896 wrote to memory of 1156	4896	msedge.exe	85
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86
PID 4896 wrote to memory of 1140	4896	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7bcfd83cd1a52c6ca92ea9dbf62e7849_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa127d46f8,0x7ffa127d4708,0x7ffa127d4718
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4704 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4712 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5404 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5720 /prefetch:1
  2⤵
  PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:6060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5016 /prefetch:1
  2⤵
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,17779219306757381718,15772277883435066809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
1e6047ed81b348d82c28154b87064b9b

SHA1
fa434fa312da982cd5b2b924b9ca4efcc17fa270

SHA256
772d77f9de2ca19ba95e1b5cbd1cb6a65183a84db11183da5ec9736618ff28b6

SHA512
9a6997f17ad70224a0e24bc6e6531baf21768e0cdc5ef01d9d01d734e19ca0081bdf10e4fe1ca423e077862fb6256d651d733299e1b3f9920bec74e4928de2ba

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
440445c5c6cd584c083e7b9dc3c7240e

SHA1
df7aad0ea4e045186d1f5ab1f2192815045a3d46

SHA256
1d41810fa5b78c8589f5891c737a62aa5ccc219adf2c1a78341ca7d1a2d95538

SHA512
a66facf8eafe1806c11a8d1c6ede5f625612199fb4d89df7bb33b7750a281880bfd94eab9500675b3022bce04eca95105ae7cbbcb0f50cae43488bb88907c981

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
57eb1dbbef9280e27734af80c034dd53

SHA1
307b427dce3d35761bddea04a337867e871b4951

SHA256
c7d7e0e8b3c44925e5e3e6d5af99fe4a216614827e2573a6d6b81aba20b7ea3f

SHA512
1ab28b2d1edc35c50dddd5156ba3fa5b6b698ccb35f8dc042e31da38d079722caf389aa0ec8757d1032d6da5a3cf33d76f6702e6def921f786ee0ede7ad069c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
78e9f7ff86cdab229a9a36390a38d5c1

SHA1
f15a71c2b23a22d1f9b4c72fb223809ba7faa28f

SHA256
cdd1c56f297e4193c589eb963d8c18079f06a0c824356e903d396cf8f5c24c6a

SHA512
89cb2cffa4c1c4b653d9c0891fef3ababc567a67dc79abebad1541147acfde76008129a04e4cd423f929e427b99bbd9347a9261ad13d5159b3b94dadeb2e025b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8af7ebc0588a6d88fa3388e5e694b8f4

SHA1
f6a444d043583d657f09a836e760d7d069f48bf8

SHA256
2e56b2da8032d6e753052f0b5dd817e41342464edbfa0084c1caf8bc942cac4d

SHA512
655d3e73887c0683d86252046f25e576e55cee63311168e90d301e2c61527287e3b9283ae3a3ed5970d7b5c0e3abe0cdb659b630379ee7511b4c0966ae9b7c76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
989f8a0d75499316c99b5731a4378b32

SHA1
8be5d61364fd10092cb6128c0b16459a385e9e8c

SHA256
01d2afd764d0471e83cf86aee571c5fe17f24d26440c9848bed67f35cc5bdd19

SHA512
93d4c7f9e49a1aef0737336f419bfaa4a223e24b908e19f5c6bcf659744eb4caf91c48ec97036bf6c564372e7e8e00797c75cdb13b09705764b940bcb49af987

Download Submit