8c6f95d5b7c9db70a6ef59641cf4d1a10f047c0da1477b03dd31aac1228560c5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

795c1e9086c643b1fe4ab4e4cc858980_JaffaCakes118.html
Size

52KB
MD5

795c1e9086c643b1fe4ab4e4cc858980
SHA1

93cba232411c57727ca2d74ef91cd67290e984c1
SHA256

8c6f95d5b7c9db70a6ef59641cf4d1a10f047c0da1477b03dd31aac1228560c5
SHA512

4a257c182dc93979813e688ecd7142fa6283d67f24f4239627896547bbe6a5b5b1dacc680950ed657af244377ecd473ad35f9cb4f3680cfaec08a74e68022c96
SSDEEP

1536:bUiX9n/cdGN0rFtgkrF0FrjsfYnYhewLpaIQKTO/an/qe+ioqcsm8:Jl/cdGN03FCrjvYN1ty/an/qe+Lqpm8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1272	msedge.exe
1272	msedge.exe
644	msedge.exe
644	msedge.exe
2980	identity_helper.exe
2980	identity_helper.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe
1544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe
644	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 644 wrote to memory of 2992	644	msedge.exe	81
PID 644 wrote to memory of 2992	644	msedge.exe	81
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 4700	644	msedge.exe	82
PID 644 wrote to memory of 1272	644	msedge.exe	83
PID 644 wrote to memory of 1272	644	msedge.exe	83
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84
PID 644 wrote to memory of 3240	644	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\795c1e9086c643b1fe4ab4e4cc858980_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd521f46f8,0x7ffd521f4708,0x7ffd521f4718
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2184 /prefetch:1
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6028 /prefetch:1
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2060,15424176501686242868,6768085304737436254,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
8b3f7c4a514b55ecc70b4e10cb81935d

SHA1
e9147e31c586e6f995523bfafe9e79182e92df15

SHA256
030175beeae61c229fd08988aee3fb2270527cfb4bc32ea19e353de03f3726a0

SHA512
8517e18a2f9f910568b51008e0a2592de0e2cd0f430609892c1b3f25159af61ef73099157de888d7133d029094b8c377f75b651c8fc8a965a1e3b4df63442d98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
74cc5682f964288efbe58eb9bf7e4cd4

SHA1
21630ba02111f7c362b50c1362367c7be4b38451

SHA256
3e6b880922ab08f73b25a03d688a32883a4e65265973ec2f590c2485adc61d14

SHA512
36268971fa4e18453e8f79381e9e26887432cf8b598d391b43710d08b7643d2e9f95bcb1025660fdf79637480b22e3d84e1b81a41b34e04332c9ef9f5373e883

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
4ab9bfbf14bd18b62e909f050169777d

SHA1
9b9a3059cf8ada91561aaaa47d9ce0f2fcfe67cc

SHA256
6299ae46e74c5b50d907c263450c356b0ee36d2beca2d7c1efb001a9d232b813

SHA512
436035ebc11cb175a64abbc18c1e358de40348427d45520c6fcdf75747ee99b50fd81bc1dd8a0908b1225a1da272157f1f86c907b36029851ae67082eeeda310

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f8168bf367dd8a9ad978c2eac5df8cf

SHA1
eceee386e86f6dd85a2a9551ce44c278b5e2a3d4

SHA256
8391ef6f556a978c141cb08bd1fcbab9969717e53374d55d2a0b890bca98bf48

SHA512
b8e57503b17a4302f0b5af9848744f2eb8153fd0e0a16e662e4449aff94b80e9c2bbc082ecd143db1f681a94e0d1b309ff67bc3acf48e8290b9a4c99ee456fe6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ec4f229be77a7896e69874383056b79a

SHA1
183e7d0abc82b7e898f552b3c06188791a4d49a2

SHA256
98e45043774ff9eb30080c979ebc70bdb9b8b2d9c96ffb9a8143d780b4cf85e0

SHA512
7e5aab8838f38697d1e5de2e01bf549d77e20e2d99b49f6ac19045d228a8f1806b8e15ca41164e7dd84577d1f717e51a57e2774139ec9d411c9a8b4ba8e9bab7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4639524e21bc104cf18829a558a7f3e0

SHA1
a91fa200bf1985ec381c0e1dac41e0ebe1e7828f

SHA256
23b74676cd487f7aefa87fd1de0352fb969db0c162a43fc68a707a26b62bce2c

SHA512
078b1276d8ba6ce9845950c26a46b62f40a8abe220141189e14fe86fc15befe848005fe9d4dd54a6f6b57c8a19fbfb1d92d394477b49a1c94c8492a9df117421

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
525e68187a49a36862075b8af6d5ccbb

SHA1
f8d4c0341e65d5c659bffb863557695b79d44840

SHA256
7203d8be44935b11d020e447566d739b82a1dc94b1ed9e06012f9e71eb44d861

SHA512
4ff94cfd9cdec4947a39d350433ab803935c5d4a87fbd865431c57f363b94477ab46c5857eaa358e76b34adce66297f5620b0dc2e007571c96b973e1ca02444c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3c1064adcc3ab48abc68e196ffd4ec0f

SHA1
20838858a2087ea94ea7add3a21d5824d195db0b

SHA256
25c4b2203e69abd030215dd71acd54d9f3c584a2cac0ecac4f5f2e235ae7fd3c

SHA512
6d79b32568ebce2f20c565f4dc543aa3be474737d4be959de64f79f1d2f5e0e96a1cc66d633ea19bbd24e8a3e4c0415e5e420a9d6e4ea8075a9555482dea88fc

Download Submit