3121af307880eb4c0b0b23de0ba826e1ca2af4f2b2be061073321c19c30e5f0f

Analysis

max time kernel
145s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 18:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fce11667e9d42e8ad84cebc5bab55d31_JaffaCakes118.html
Size

19KB
MD5

fce11667e9d42e8ad84cebc5bab55d31
SHA1

b3b93145dc7a6ced993f26a4f7ed72ba6c066666
SHA256

3121af307880eb4c0b0b23de0ba826e1ca2af4f2b2be061073321c19c30e5f0f
SHA512

5d88f89640b88644b28e6d5e899facee5e3fbd4a926b699657db0831b337feeb9bbf65a525323c6357637b416685ef45d335560c5732705c6bea99e2e9a0e42e
SSDEEP

384:LnFppqz3gY3Uf0i3gyzg7X/RzTjGhGBNfkp1mOfT:LnFppq7WnwRHGhGBOp1m+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4476	msedge.exe
4476	msedge.exe
4664	msedge.exe
4664	msedge.exe
3696	identity_helper.exe
3696	identity_helper.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe
4664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 552	4664	msedge.exe	86
PID 4664 wrote to memory of 552	4664	msedge.exe	86
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4048	4664	msedge.exe	87
PID 4664 wrote to memory of 4476	4664	msedge.exe	88
PID 4664 wrote to memory of 4476	4664	msedge.exe	88
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89
PID 4664 wrote to memory of 2032	4664	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fce11667e9d42e8ad84cebc5bab55d31_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff90be046f8,0x7ff90be04708,0x7ff90be04718
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3920 /prefetch:1
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4948 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6168 /prefetch:1
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5764 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,3129760656578111879,12895850960602352571,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5324 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4136

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1792

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db1ed3bbcaa8e96c29a0b57e72bf0319

SHA1
9bc11860837a2bcdd048613ba8dd76d6d77d32d9

SHA256
7c7db5dde536599fd7ffd4dee8e03ca0f6680e662022869057b09a4635b9b87c

SHA512
eb7375877e9b51ebcf8cfc62cf822fdce3fdce837fbbd00d4d54c52c4f67bd82408e4809e1c92f32e9f3edc9e6726910f752fbeaf14704745688b0239405e6c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4b5eaf7edd9d5391ddfdb694e0cd888

SHA1
d1f92fbd238c4d5fb6861a83153893568d514586

SHA256
1d5fc1e6da67b60df30ee83dd11359ec3dbe0c4bdddff2f2f862fa9c4619d903

SHA512
1b62d5740572b1c17dadcb83d9e0017d6a8ff94cc64bc024cc47fa92a8180f7c2d18bef79ddf5cac8a9a97ecefd8461b06665e522acb0c5857dac1a2838fc048

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
eb0c2fd40598560a5dfe668ceb167a82

SHA1
d31a331fceef09599513aa0ac96215072629d5d9

SHA256
4028f6de11e831133bef391836fec3b0ee06b8cd1097530c7af742b42a62104b

SHA512
8171656cc8e9609be166223f4f6e42322cf346bcd2025b9cce19ab3a59a3ef15fff1e2f16ee0b1b2bac8d9f50dec0b1d06a10aa58420f2242e968c802a302769

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
cba07b405a692a40f8c2368f3b22bc7e

SHA1
afc12511b7660a008fc5babe82d5e98dfccd4288

SHA256
aa30c8e8f944c5ab80085e087a5b766906c9c961af4150044e17184191a190ea

SHA512
0aea7d354966780f3a8aaabfeeda17663aaf4db2cdd942a19c0c70d02aef7f1c05b57195ce365391fcf8973182d0410f35bd27dfcf68b5c7c7391d4f57eb4e48

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bc08ddc1da9031bd78d134a598b9f0c4

SHA1
a1ed83ecdc2787b271b2ca9f204e33b70cbb7aa8

SHA256
402022755a2f3b6dbc355d9d722d627265d2ee2951e312640177a826389da6ad

SHA512
ee3d648769f4672544fd0ebe70c21cc137f0e1332f9c991b22eed1da6c846d20ea5a82a16c47ca28ebfdb8414e4c7031d002ba5d5b4254c68d77ab8815c70cfc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
757fb30fbdbfe2931763e9dd48a25bfd

SHA1
5d97524a7cfad628772d8bdc4e41cebec88c9230

SHA256
5404907ef971aa2b7e5e6ba36690d7f00e52966ec21476ef91a11ba622ec0046

SHA512
c5e6a031d32aae9cd4c658aaa1e4e46cc808765b535ba4a1a7d3c17aca4da9dbf7b419af4103da09ef0a1a84b7bfef239db3e4a4fb504b3fdaccc1a13be5e302

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
941ea4c983b3cf877ce6e1aab38f2794

SHA1
c4fcce581d0660a0c96d0579aedb528a8168233c

SHA256
3d4479f291d239eec609801437c1962e41e19c53a3eadd2f95342167fa7ad342

SHA512
f47836cc619ea50f24d3804a697bb562781e812a65285959d7dbce53db8945cbbab2f9b8290ba2bd9925f620858918ddc676c082cdadae8444a9751d642a381b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
9KB

MD5
833bf60b2c3fd0cd79102b4246da2359

SHA1
638ff49db86f9fcf17c4e5402de3a16855bb87c5

SHA256
2cdfa8baa7bf50f33c77f3ee1b3f622fa88f72f827f80c64347ab336401234d3

SHA512
737fd4925dd21096dd8263605a398ceab13841292800ceff81d3d7dfe7a2a13bd9734017ad89a8e67f3348da2a1bb9aab90249cc11e668839be54536bc313aa0

Download Submit