39bb5f4fe668a4d0ef9f02e6c4de7cc9e74f919db81b3513abe18d9e98a1987d

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 19:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

3ba0ff02292af98156e936bfbd093112_JaffaCakes118.html
Size

1.0MB
MD5

3ba0ff02292af98156e936bfbd093112
SHA1

80a4d16d14ff5303366d83e9619c7b860a945158
SHA256

39bb5f4fe668a4d0ef9f02e6c4de7cc9e74f919db81b3513abe18d9e98a1987d
SHA512

809a56d1c79ab78f74ba564ec32d09b38d847b0092b47addba3251cb61fa871d4552bc12472d356ac40958f3da95f2b0fcb3b1376ab941769319bc77f6cb8375
SSDEEP

6144:7kclF6of6dhNE+0Qq2yP17rBMj3zeH0yWe5nEzDnxUOaElwdyMuLVWh:7kcl426ZE+0Qq24rAO1jQLa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4488	msedge.exe
4488	msedge.exe
3952	msedge.exe
3952	msedge.exe
4456	identity_helper.exe
4456	identity_helper.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe
4956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe
3952	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3952 wrote to memory of 4564	3952	msedge.exe	83
PID 3952 wrote to memory of 4564	3952	msedge.exe	83
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 444	3952	msedge.exe	84
PID 3952 wrote to memory of 4488	3952	msedge.exe	85
PID 3952 wrote to memory of 4488	3952	msedge.exe	85
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86
PID 3952 wrote to memory of 1644	3952	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ba0ff02292af98156e936bfbd093112_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa3a5946f8,0x7ffa3a594708,0x7ffa3a594718
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2352 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5176 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5452 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2272,3787598981302591323,10769929697887576809,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1872 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2104

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9d6399604e7d1a5ce6b15d1cff7ac636

SHA1
1db901e84af2a9f6980ad4d1eda7eb5c48ed7cc5

SHA256
9ec49f24b750e04c359b6289d064d91fb7d01c1a25bf95402fe5833f7bb2c248

SHA512
62871a030d6729512793ca5e31e7969be606692e615e127d6b533b4ebb1ccf649c7cb75c2bed6e8dac75ee7af8070820f41efda5cefe4a8a9e91974d3f638403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d250332288b4a13afd6cdf627e58e490

SHA1
2c2bf1e4eeebd5f330d4e44d830dbf52a8be9e5b

SHA256
f5488fdcfbfe75b8ddbc63371935d6d8fe5890ca52668f857c7d9b47fbbf0f62

SHA512
7cd576d3928cb7f8ca0337d9880f669de95c9ef24211df536fe499ec29352b52077a7596329c5f60a8b248049d0fe9b827c539e3d86eff297ba87e7c17e0b17c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7cc126daeffa9b1969a49acfcae066e5

SHA1
8fae02e4b9184ea31832a6ef897e7c9f4d30abe4

SHA256
d13f6e1588994a3c254956de86b88a7d8e5448e9f53766311689c8bc9ff6ccde

SHA512
8912ba00d25cbc6e179db4fcf123d2aaee35e15c52f2471b057bc2841dbd6f50dcb4c706802096175b67634fa8cd34ca69ceb5bab1c738aaeb10386b7ba7d6fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c6f94d3ca9d9d6b9d27e0ee3ea99e52e

SHA1
2ac6af185ec132b31788f3a6ced8e4f301b5ae09

SHA256
3b1a4c6b43310f31b7de60a6096197e69bb9b2b4f9c00cab59ad2f1e013dee10

SHA512
5e8af63d06d81c3a2cb5104df4b14cc45627aa66dec1baf13de8fab125ede040d399ac199f3227fb0ec175b8d04ff617a8bc82992a72cd8fc69ea9a9bc4a367c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
61211e5ee5fc167f3c0b92e365caac22

SHA1
15e9baf190bc85d1bb43e019d0b83418710f4b5d

SHA256
b7d9f7912c7917ad72b6d504aedee3177ac27a8e20ade60fdfd212fd7ff08865

SHA512
b396b00d4e9610ad801d0d5cd1453a9067cc602e07f7c517a43de6e75a790757ac52bfdd94f82b9608cfa5d7f651d417c787578c54a0e7fa2c5ab11a4d33d616

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f8244084f4370e113014ef101eb3a3bd

SHA1
279bd1b3d2cfc8babd07e5297e1f050735d736a8

SHA256
f9b0d2d22426d2e74f35997036bcc38f26cd4db09197184e6c238ea9d98032a6

SHA512
10f7696e6e9b4115aa3a1e2287d9edf3c37829c56a487ab9abc6ef566d2b15cd24add6b05738971de89ec1be42e488190e1ffa9f22b6d7255fe1eccca81fed8a

Download Submit