adcb4a60c36a31d78712479ebe05f3b701b24532cac4186435337dce161760ef

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 08:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2010fefb89f29b92530b7ae39f3fe1b2_JaffaCakes118.html
Size

45KB
MD5

2010fefb89f29b92530b7ae39f3fe1b2
SHA1

0f2f752807fddf662df8e06eee0b9ad206fd3839
SHA256

adcb4a60c36a31d78712479ebe05f3b701b24532cac4186435337dce161760ef
SHA512

dd0d1012d3636b852cd5af146a14960fcbae03289d39594eb1aaa09a2c458a493c640e406f4a7156167604438de631ae200c4e811372c8c26ab446f9ca8970f6
SSDEEP

768:AQkqNji88e5u9h2RkRmbBRRBzfyf0+7kRcI8PNja5amonORxRyhI2CHG6:AQkqNji88/Cbj6H73Nja5amonpIrHG6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
372	msedge.exe
372	msedge.exe
712	msedge.exe
712	msedge.exe
2936	identity_helper.exe
2936	identity_helper.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe
5520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe
712	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 712 wrote to memory of 1416	712	msedge.exe	85
PID 712 wrote to memory of 1416	712	msedge.exe	85
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 1740	712	msedge.exe	86
PID 712 wrote to memory of 372	712	msedge.exe	87
PID 712 wrote to memory of 372	712	msedge.exe	87
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88
PID 712 wrote to memory of 2884	712	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2010fefb89f29b92530b7ae39f3fe1b2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa44546f8,0x7ffaa4454708,0x7ffaa4454718
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6884 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6896 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6356 /prefetch:1
  2⤵
  PID:5340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,6528575597397684097,14813278526726828910,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5520

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
336B

MD5
f74b24d99189a8a3de67418e2192be3e

SHA1
165b7b4b11f269b122c449e9ec0ff312696b0df0

SHA256
82ed8aeba61025ccc8f98b6542c83dff93e7ecb8b9bd7890751888332ec58e2d

SHA512
3e9ed1a2a4e5ea3e87a77b34d4b5ad987515380bfdc2c1ae9840f7797cf6f1152ea71d489e60a956966e66c7161a8113c811014ddb4a1e479715ae46f95af7d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
351348ce34f034356b654313f40eb9ef

SHA1
34120660755b043e352278c28eb4c02178986b57

SHA256
48f7dfd2f33ad95659d91fed758f3a7c44596b42c86784b80881aae6be70dc78

SHA512
b5d21a295853ee4829722698ce25bb4fdc6eb86a84592e0f947f276286bedfaae06ef81da07447aeff302fd1cae64934feb2b0dc904044727ba547be22d373b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b542c123a8d012b2391118f9f2758767

SHA1
0f6a7dcf2ec6ed3f4225e172607972c7f673893d

SHA256
051143546c2f9a5ca340a73792d59e3114d35b5f975fb3e64b59a477e6e139a0

SHA512
c82a1eaaae4c455af3765d17b9e9714f9a053045e595174f82a5a1e8b5ccc6fe72146cf42f88c8ce9b3c0f545622202305e614c8b46a52cfe7e07fdb75d3f43b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
a33bf437c8de0039e3a92d29f4af4102

SHA1
8d199203504d273ccd7bd81cc4cd0808d1627741

SHA256
62c37628be8e2bed7a5b3c53831e37e757a06858bc13909fc1bc6f58b8938833

SHA512
3967d832de6908fa8fb78f851f00d05c055f36645d9b7b3e2eb86817fbd1983d382fe6f5b5a88b9463b5fe14529e1f9ac05d5a3e2d9f7a8153ff08ec58cb29e0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b0b4d8ed-5727-4a43-b4f3-0ad2d504e1dc.tmp

Filesize
2KB

MD5
7d994acdcb22f5683408513c17bcd54b

SHA1
7b04c2ce03dc98c926a4f0cd8c67f3eef53c6477

SHA256
0b06ab61d8c496197d6eece7dc96b22d6bdb25ccc2d923404e642149c7b1d003

SHA512
8a0f8fdc112095c7fb069b20d0d8278946f561ca36af9c60a3ea43bba47d20a3cde24d946909270c3fddb62431971cda62c77277c282268eddf88926d572005f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd65a6e8-1919-46a2-9094-e25020faccfd.tmp

Filesize
5KB

MD5
a3a5b60231047227c219dab76ffb8c29

SHA1
d99484864955f85866d154049ad1e09c7c8b2bcf

SHA256
dbca5848a2832fe614e67a9ed88e2e7ce171ed4f821c743e7bdd5fedfc71892f

SHA512
633b07b280a2efcbdae94244b60d883d4d897a4fccca5265d24dcdd4a3fa9b30f9baf0c103bb8699c57224a2fa992541800970c76fb6c5940813733b8cba82b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
462fc84522a4385a464bd3ad088d7417

SHA1
f5af4a6aeb5ab1d2488772d1e30acf69f561768e

SHA256
53a2224d40749b81ad7020345dec1ef37393274ce4de83cbc399d836632820b8

SHA512
f673ca56cb4716af83495778f72e920c3e13693e84fefc764db66231f192cb1ce4539318e2a6b132820f3ff5c51590d3fadc2b5ba04069b7c47a5f90aefe91f7

Download Submit