ff670d98db756a93ccae097975a0237830681a81d5474cc1da257dae38939c51

Analysis

max time kernel
137s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 03:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ba410377b2d01b729c50c45daad415d7_JaffaCakes118.html
Size

70KB
MD5

ba410377b2d01b729c50c45daad415d7
SHA1

e910c05eb5f7639745fb88e2ad60e38b477a73ee
SHA256

ff670d98db756a93ccae097975a0237830681a81d5474cc1da257dae38939c51
SHA512

cca2fd6ebb60efd6b3f5e92305ce911f2feea4f444e14aafd91045afe03ab321d3fe058a82e242d3af6655f433747ac28f8c07a54d2dfbb7b865303a8d8cc825
SSDEEP

1536:vg2klc9klcFklc7uG/bI+3pkc9klcPEijZeqhsEijZeqL+VfVqKBD6b+YeTeG/sz:vg2klc9klcFklc7uG/bI+3pkc9klcPE3

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
4736	msedge.exe
4736	msedge.exe
3636	identity_helper.exe
3636	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of FindShellTrayWindow 26 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe
4736	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4736 wrote to memory of 4276	4736	msedge.exe	84
PID 4736 wrote to memory of 4276	4736	msedge.exe	84
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 2780	4736	msedge.exe	85
PID 4736 wrote to memory of 552	4736	msedge.exe	86
PID 4736 wrote to memory of 552	4736	msedge.exe	86
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87
PID 4736 wrote to memory of 3568	4736	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ba410377b2d01b729c50c45daad415d7_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe7afd46f8,0x7ffe7afd4708,0x7ffe7afd4718
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2088 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=180 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,4058873437995567493,16867651775810670108,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:3312

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\893eb030-98de-4b66-9af3-31c6d69f3727.tmp

Filesize
6KB

MD5
b2a88ae03159c602d8f05af1d5aae975

SHA1
f0065eb16fe10ab1c06d55003af3dc57673bcf56

SHA256
3c9381cb1c43ac0ab0bd404d1ebbed04109f3ab38c8df97c1b6eaaec78bdfe51

SHA512
5476cb371d3b1ce4d8d1746075f8983f48fc51550512cdd27481467b6e9e5b77c443a64fd052d61f0519e272bab03649b030277ad44d4a261ad1b7df384ce93d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
f9d81d42823e2e1b55e9130c39444e04

SHA1
c29944e45f677f61f366a3e72d196699ca3a8e3d

SHA256
964d3ba68789eb279b200b18a1a8b2062f936952e69e835dcfd0b33ce62d6468

SHA512
21c013019d2b11da612fc2240c2b2450bdf01b0cc048c4143c87c9aaa77342b886ed1a7e17e93565fb58137d21b00cc7ba831c3c84a7cf27badf5a5ecf00648d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
aac7f258ca95168a663cb5eb41a11a9d

SHA1
7ff4041b193f702bea89964650ffd0c5c6f8333c

SHA256
e995278ec7185459fc6ff6095a746e5cdb0ec2e80e00cff28a87499d009533fb

SHA512
bfaaf3386aefda05078979164d028e445707282936d80dcd8d9c91d85426475e50fca8ae4027e3fcdb0c32e40af41287b28f9fcad9736c441c1e19e4d681c086

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
3cee4b4205d49683ee110e5d2e16f5c2

SHA1
b48e8f64ab0ec44f661a24b9848ef9974870e6a4

SHA256
310c65edddf1655baeeb216403d319c2cc89a5807c3d676cb3fbb1b3143a1669

SHA512
0c0fbc08b6acfb24ae70b79cab041a82c395106ff335f0edcc338d8397bae7a578a71c615cb2fba549dddbd6093c604b181ec9790c413f403531bb70b4e0cafd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5770f578775ee8053bfb430cf59be86d

SHA1
ee292bf71f442ebcde9a00a67f44d8902798dd85

SHA256
a9f6ccc389d3012de5dc0252b37610503891f09e05d6b5666e95055367f5e7aa

SHA512
5b164bc5f298c9145b61680592346b540d284fcf63c80ed402651c10e6507bb02ce0b6c49b84d4aca37e3b01413da8308aa3089c812ee2aa1ea0d6004a9f729f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5389a7c376428f7bc9eaf154c7119496

SHA1
6c2d302dc0fb045593856f1024626c05a7195167

SHA256
c9c73afca72e558a5516efcfc8dbfaedd7852a529f4d475f2d5c77a4076851bb

SHA512
dc95e93e88f5830497cb964c7d2aa99952ef34001a2508a593b92d0cc2ce3054f14908cdcb57e798a70ce626693c32da11834a9babbd851d37f2f8107521a910

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2f7db0709c02f7a710211df19f9775e1

SHA1
3abcf44eca91764a3163606b0e35e6103fc3b3d8

SHA256
b28351ac95cb9c844694dc4ab81b7b12df2debf6497dbc174ad7f80df34384b6

SHA512
2acbdcc88eb0db174859a0b625dca2c3ed49a68d0f8c9dffb58adb26605cad92717a45109fcdcf3ea4973ad9f369721a721bc0e6d16368a3af97d13d157d7732

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5977de2ab8bea240a237029c2921e95f

SHA1
e0e7b7d3c61cb3950575d6ad2394159a7bebb1ab

SHA256
7fa5e3ef52e6f186efe3e7e2aaa4b0348eb1bfb464edc6280da0657ce418b1af

SHA512
11348a5967597bac5ae5c8d1a650061b11d0a3531fc741fc966d2963aa021b43e14890e19ea5516b941e2931683b859c5658f1dd961c24fcaae692c1e4acee0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
12KB

MD5
342fd5391a9b9dee67c053e77e4c7d4e

SHA1
9643aa88364edfc2d3364945dd1483d696c944c1

SHA256
7d0f07238888d5382d1d68ef160074a23ca450649ab8885d53c1077d3d0eefa4

SHA512
baad92005c0f3c99360b1e3441d6459cd884ad2efe8a3d0b8c0bc4f391689bce5398384f4f56bcf64141469c2ba1651d572272322a1dec6bf6d0cd5ffed013b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f5022166e0e84e6c8ab2618f5fc7f2a5

SHA1
81f4fe812c66a1859c947db2cc30086e8a09da1b

SHA256
e801e818d6e24ca5c74d771005f70e1c4dda05d672f8f909963cc10b9d0eff9d

SHA512
5f299dcfada2aa87600d797b8a8d3c629aabb40541b1ad81ac45c13df049b81c39774a73fbef5aa9ee9e7d2722c3c1b400b0b15baaec3a98374acc23f93a7c3c

Download Submit