eafe3ee39050b7f45dafbc58ef10ef3218141eee798716f9da6ec7313d2ed33e

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
10/04/2024, 21:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ec12ca779315b8d0f1821089d02dc02b_JaffaCakes118.html
Size

88KB
MD5

ec12ca779315b8d0f1821089d02dc02b
SHA1

ec3aacb6c8cb534eee94faffdbdafbd15ecaae95
SHA256

eafe3ee39050b7f45dafbc58ef10ef3218141eee798716f9da6ec7313d2ed33e
SHA512

5d2939d090c66588c49161c89d508e3e3db16e695b33a0d922fd36a878dccf64a2d613825f4f13513abb06eab819f85ec6b4aea467da3219dd07d0349ad21c45
SSDEEP

1536:QDxNY785s27P9Bc9IZ+Wb4Os0N1NxKRkuz1MlKkNzU0GIw0H71keXuWrohr4nxMd:QlNY7Imk+z1MlKkNzU0GIw0HJkeXuWr8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3908	msedge.exe
3908	msedge.exe
4600	msedge.exe
4600	msedge.exe
1616	identity_helper.exe
1616	identity_helper.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe
1940	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe
4600	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4600 wrote to memory of 2908	4600	msedge.exe	85
PID 4600 wrote to memory of 2908	4600	msedge.exe	85
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 1612	4600	msedge.exe	86
PID 4600 wrote to memory of 3908	4600	msedge.exe	87
PID 4600 wrote to memory of 3908	4600	msedge.exe	87
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88
PID 4600 wrote to memory of 1660	4600	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ec12ca779315b8d0f1821089d02dc02b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffef72146f8,0x7ffef7214708,0x7ffef7214718
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3352 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1896 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16030821425221346127,14304449498090210077,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2096

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4d6e17218d9a99976d1a14c6f6944c96

SHA1
9e54a19d6c61d99ac8759c5f07b2f0d5faab447f

SHA256
32e343d2794af8bc6f2f7c905b5df11d53db4ad8922b92ad5e7cc9c856509d93

SHA512
3fa166b3e2d1236298d8dda7071a6fcf2bde283f181b8b0a07c0bb8ba756d6f55fa8a847ca5286d4dbabc6dace67e842a118866320ac01bd5f93cccd3a032e47

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04d66ec2-b1eb-4ddc-9b3a-2c54b287c2da.tmp

Filesize
912B

MD5
1ef5d78f04a50569248f524e99a643cf

SHA1
9f54af2d6f0ae05c14584a31127d31346b133665

SHA256
29ba9b21de55e88f8759b2c86b4285e765bcf3ba328607b662ff42be2cbf43ca

SHA512
f5f8d29b476197aa6d39d86b942de5dfb714959693a1c1d35a4f50d896f0f4f0615a809f16269f069fd28c9a5070977bdaadb02e737f744aa7762ec375fbfcc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
912B

MD5
010cc678547bdf6e5867b49bba869c2e

SHA1
ce5644c71ab00d79b4ae64eb03d18fb2ebfae982

SHA256
e6b70516d9da0f748caa0a37bd76da522652975e38400dd85490ebc018d82863

SHA512
f533c7dea121805fac56db4ba9fe63dda1e4b8bf7952742922de079d99841b1c9b575d34fc9da7bffabdd0bfe0c028ec13013c57a4ef762cafbc65468c3bc0a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d677abc7c85c804abd4d01a4ba40f428

SHA1
3fd645227b52d2b25e1dd5f600f3e95c27367930

SHA256
2b980eb78af5614a87fcec0ba8454c309e9b4d4bbd473b730b4f7ad802ce5c3b

SHA512
fb8735d7666c3ee711f7d7791a06bbf8a0e2354dd446ed4351544c92d5d30d61e3fd53bfcfc314f4d5f26457642727723c8922ce6132998c5bfee6cf8f05f827

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e69eb581d185a9a09e08fe82c0234ec9

SHA1
ebddb2f28171cf58ea13c852bb8ae2c81b279120

SHA256
eb3bcc3bd3691b40943772723e3298776a42db9eba3e564230b61f60f5be0aa9

SHA512
8c84c9bbe61aa42fd8edc3bad0bc33e9b10ca984b8f1f67a6ccbde112bb2cd3869f6689c5579209a7cd819becfc1753f46ee960a273088e9b2eba9aa37d34d13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
88566aa303ebd6b4d50428b1d444e73e

SHA1
5adcda090e2fcb36c59076f97b65558cff3bbabb

SHA256
ff258f91f4251bb6d632d6478825ca0742780582b16d092770cf1c18ad99dfb4

SHA512
efc07b7eed086ee1a820ea85657e4259253b7d38170e2d75eb132bcb2a997affd2aaab46529b540d6032ca801f07448b065639fcdd48b634736197968ef384d7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3abf3f11e9634b929e4a5ebe67e8eaaa

SHA1
b50f6c696578c3df1cba8498be5ad96bec504ea9

SHA256
41f9a914706348e2e4492200ef643d6d0cda7f469e71a0e3cdf153ea830ea359

SHA512
5475529c3bf04152b4464da846f70e973fea3bad268536fa1a86db9c525e5df029f6b8a4933a248045de6dab5e5a13b2bb9bf3de4c142d36ca8076d8b78a95cc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
c2ef1d773c3f6f230cedf469f7e34059

SHA1
e410764405adcfead3338c8d0b29371fd1a3f292

SHA256
185450d538a894e4dcf55b428f506f3d7baa86664fbbc67afd6c255b65178521

SHA512
2ef93803da4d630916bed75d678382fd1c72bff1700a1a72e2612431c6d5e11410ced4eaf522b388028aeadb08e8a77513e16594e6ab081f6d6203e4caa7d549

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
366B

MD5
4292b00d8e52a25534ab425d08453c1c

SHA1
a1c50627f71e272775eea76dfcb509f1eede6efe

SHA256
9da17ecfcfd03504abb3d7b74d3cbf301f31571dbb031cf6c9adbb9f17070096

SHA512
85a5b393de4f85b9871f0e69f14556b0d57c291d51bdb507cfb42568928055809eafd9b4a5d81b9ec32202d1f2afb6ada6613cf60dd380c2f4f160263963e839

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57b90f.TMP

Filesize
201B

MD5
576ef16dd68a2a75b8bfc448dbd33392

SHA1
970fe1a9570241ab66c3afeadf18353897956dc3

SHA256
7a2b2b72f4009a0cff69173402d657bcc1548c8c40349e86bfb33213ad727270

SHA512
0737c07a561bb7537487224dda587a27c46e6d06ec2798c7f72d58a3b5eaa1074cdec85a7d834df6fc6e99750614dca20c82cbce3f803c83b2606b47fb024cc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
86eec9edbacb6486359c255a74922d28

SHA1
692ea6f1730f8d8f76357aef0dba43171230d61b

SHA256
cf1e734fe72094888be25ac1b00235e7f4e4abd002e49f1c1667ee667e39605a

SHA512
9ebc39d2a3d6a4a499de1eb546d8f1d5076a07cb800f53e61a2ebf5924c42a0b4d440e73ad8fa309479088c38d9c036ef3f9b9a9c65516b2497dd39ab87630ae

Download Submit