041802ca51328b5c92998cb40479672a9898ed8ea42ba26e28265eebc5f8c010

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 04:53

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8911c745530ac1531c536aa8de2369f9_JaffaCakes118.html
Size

124KB
MD5

8911c745530ac1531c536aa8de2369f9
SHA1

402f62b3b51b056f34719a360a63df2f19267736
SHA256

041802ca51328b5c92998cb40479672a9898ed8ea42ba26e28265eebc5f8c010
SHA512

3507d5f45d8d480d44b4342e9495b6ffff1a640178a3fb327939d8ee7b87f43b08d07c8f922dd52a12071d72dd56680258b2f65d2c106ca52798e06593a98e23
SSDEEP

1536:wipje05IqZcBGFexGJqP4fJyGP8J4wLpsGC26K53IgJ9gIJZtoMlu/R19/mhksUM:wipjeVqZ5OK/OWOPyiUFHGBnKZ6ld

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
118	sites.google.com
124	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2284	msedge.exe
2284	msedge.exe
3560	msedge.exe
3560	msedge.exe
3856	identity_helper.exe
3856	identity_helper.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe
4676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe
3560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3560 wrote to memory of 2588	3560	msedge.exe	84
PID 3560 wrote to memory of 2588	3560	msedge.exe	84
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 1600	3560	msedge.exe	85
PID 3560 wrote to memory of 2284	3560	msedge.exe	86
PID 3560 wrote to memory of 2284	3560	msedge.exe	86
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87
PID 3560 wrote to memory of 2864	3560	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8911c745530ac1531c536aa8de2369f9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8a19c46f8,0x7ff8a19c4708,0x7ff8a19c4718
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1808 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2696 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6176 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1932,811866418570031488,10408978491030927020,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2200

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
21KB

MD5
dc52475756e1c2cd28a642483362cfea

SHA1
f3ac327ef03dcde06f67e14c832fc8192720c5ea

SHA256
101e409217ecf85114a73cb222e256680fed2c01985839796fd7ee33abba9f2c

SHA512
51d10255550361a1d3bcb0ddda3402e7479c7babfe109982d6fd0143df08699ddcf6119c09b6f3ba357419a6d2828815c750a362c67a7e10b3159df8702af4a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
135KB

MD5
cb98a2420cd89f7b7b25807f75543061

SHA1
b9bc2a7430debbe52bce03aa3c7916bedfd12e44

SHA256
bea369fc5bdd5b9b473441583c46b9939232bf1f98c1cedf6bc2241c4f5068d4

SHA512
49ccede4596d1e5640a9c8e8be333f9c18812d58f02b2b15adb54172df1387439e9dc5afc4ccd9d8f0f75f092318bed68d3cd577338e88ef4f9373de8a07c44e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
0d3538902d3018d9fa41729368cee604

SHA1
b1514949f14c7c38424db153ed570dfcc038b826

SHA256
8fcf9dc7c00e144fb7b4917495e49dbcaa9a8faf3b8e3982e4bed650051f3173

SHA512
2c873a45d1e02b54577a5519f98eb6aec40ddbf7d7923f6cd143db1ccb86ece592358cec5a0475de51e7653e48e04d1ad61a5beddc557b5ceebf3f40e2eb6733

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
81f67a5a558af49b0184b2e22fb6ea32

SHA1
28523c1054966fb804b520187b330d820bea5be6

SHA256
4cb3de2ad2722f209ffb31f977644a04a54522d20f1233132bb07c3c6f2f0a3f

SHA512
5924dbeb6f620890939c08ef1df369bbdb04d535dd05fdfeb969b2aa6fe7f9b5514a9b94ca0a9b941c8ef38c15882ac451e7c8e4a6fcb05ff83adcd31abfd9a5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
14e0b66100d6e3e73471696c3485b62c

SHA1
67cb8358a1d6e1bdf5964cb2c96f287b711ab63f

SHA256
4b1086d6b7c328902c25756988c007dc92a935c761d8c525750bd5474795a510

SHA512
b04a6ff0c060adfcb19cecca84a95ffee1c90ad242bdcb82802029aa39f77b1b78f19ae2938a4cdfff8748ac6cbc382a52e3fcef19083a5ec5f2433d41403698

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0d7aa44aca70b00d313299ad62e6ec83

SHA1
9b508161b25690ba3d34ff41f93326d41bc3c436

SHA256
d459e21e6a1f1f7a581b626fb6895c4cc5dc1355de8bed63f9e28b48a50036ec

SHA512
6c28ac11da0ecedc12c36db4894b30519c37d15479475a6f8720b420bcb3c828ea14e5030812d00260a4bab06aa68f21efc1c8510dc7998bcdf78047058af82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5a84c18d0644786335bdebd284ee8af7

SHA1
f3aa1e7dbd169e77c49124390211d64c5998814a

SHA256
3a9807516927a615c8626e41b83aaeff0d090bb991623ccce0c577b9f7d2b594

SHA512
1caddb25c9ab3559b664e09db6b78f8d5fd9a3903db2b151a5318d966dde2d12383b38407b772b0de7449de61e0d959df47a8dd51bbe6e98337a70b5bba9ac16

Download Submit