6dd8a4c392cc0b06acadae8719c4306566dc8167d7cc52288c768f31ee4ccd77

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
05/06/2024, 14:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

985ec6cf2adbdcf70c6d74aeec7a5a0c_JaffaCakes118.html
Size

175KB
MD5

985ec6cf2adbdcf70c6d74aeec7a5a0c
SHA1

bd3a157e253a6c676fc42b500aab5d0460133ad0
SHA256

6dd8a4c392cc0b06acadae8719c4306566dc8167d7cc52288c768f31ee4ccd77
SHA512

e7c3c948758a2f97d8047a517730469be02b28a87a75a40a5b93bb74b8a1f8fedff24f59f4c8bddec08dc569e454e5bd42be4b0d40c9bb8f173edd76f1dd3609
SSDEEP

1536:SqtY8hd8Wu8pI8Cd8hd8dQg0H//3oS3XGNkF3YfBCJis3+aeTH+WK/Lf1/hmnVSV:SBoT3X/FGBCJi3m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
5028	msedge.exe
5028	msedge.exe
1476	identity_helper.exe
1476	identity_helper.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe
2612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2612 wrote to memory of 4156	2612	msedge.exe	84
PID 2612 wrote to memory of 4156	2612	msedge.exe	84
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 1820	2612	msedge.exe	85
PID 2612 wrote to memory of 5028	2612	msedge.exe	86
PID 2612 wrote to memory of 5028	2612	msedge.exe	86
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87
PID 2612 wrote to memory of 1276	2612	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\985ec6cf2adbdcf70c6d74aeec7a5a0c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc5b1c46f8,0x7ffc5b1c4708,0x7ffc5b1c4718
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3208 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4724 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5036 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5568 /prefetch:1
  2⤵
  PID:4912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,1848734992278157711,18224465153988700848,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2144

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2daa93382bba07cbc40af372d30ec576

SHA1
c5e709dc3e2e4df2ff841fbde3e30170e7428a94

SHA256
1826d2a57b1938c148bf212a47d947ed1bfb26cfc55868931f843ee438117f30

SHA512
65635cb59c81548a9ef8fdb0942331e7f3cd0c30ce1d4dba48aed72dbb27b06511a55d2aeaadfadbbb4b7cb4b2e2772bbabba9603b3f7d9c8b9e4a7fbf3d6b6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecdc2754d7d2ae862272153aa9b9ca6e

SHA1
c19bed1c6e1c998b9fa93298639ad7961339147d

SHA256
a13d791473f836edcab0e93451ce7b7182efbbc54261b2b5644d319e047a00a7

SHA512
cd4fb81317d540f8b15f1495a381bb6f0f129b8923a7c06e4b5cf777d2625c30304aee6cc68aa20479e08d84e5030b43fbe93e479602400334dfdd7297f702f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
33683e4a4673f42169edce32e83e6d3b

SHA1
d17df1a0186cc584732ae4f4fde4a5d069e8df6c

SHA256
8915c3de6d499e35f8934df60f9cc22c2c572185177c17fa2e2de97e0f2e1bda

SHA512
e6818bdf5431621bbacae29bdfbc06c3656246f7177b11501ba3f29b21f7781d41de68416d189952fe5896eb73c1a9d5015b10e54c19aca6ae668fb4de322b81

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7ce0b03b557679914bbc8124e2ff989e

SHA1
3607c76b65cb18ae6916dd6d6f16c8c217ad5cab

SHA256
9b86f92cd540e38ff41ab62a7a4ff00758c50d603eb7badc769855ab351037f6

SHA512
b81f13d3d058ab0e6f42ed698bf76f3fde33b78231735cf4b8e7774f58a4657d912b85cb9fefb6f891e46a31f060a0a36991714ef0e3b366405604c7225c5a02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2a9e221f01b1637aa96f63b743726763

SHA1
31c8c17dd4bf951159caf61df1fc2812ddd7917c

SHA256
87fe8a777faa070b287360bea14fe1f5de94102510f48dca440b0ea73a03f892

SHA512
86c83f6e9826713e2bac1ca799e5af3ab52c7005a1c92bfae5b855fb02a7859368fe5be90062c0a979cc2d1cd401f607cc63b425f40ba41efd327694badfcfa6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
635e3cd9d741043693294c9f08e35404

SHA1
abaee3b684f3227e0e3c46ba08016f9bdc721d8c

SHA256
5ebf9c9aa675f5e5d0a34fd6c4433aa49cf9e7ddc7ecadc4c50179de6c87e2e6

SHA512
2be6652e0cb2e324da7939b32051e54ac4d630a1098c253b93d097ddbaa30e5c627df8d7800643fddbec855d323f2cbd115b5fbee5a1a05e2f0f74535bcd08bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0ca62dcda152bc5bdeffa661bde23c2c

SHA1
80c94a2c4da448b3f50620ca315e2c8fbba9f2d1

SHA256
f20663460b3c73f8d666796c118780f206523efd0c1d248eb82b40cd541d65c0

SHA512
e4185117daf7a3e507aea05df315037e5286a61a5f1bc65bb8147bb442df6967419ac6acfab2d73692436c27ec0173d7ec7eb448b48b2e612f7c8db68a589140

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
172fb28c10d07effd0c53deeb7a1fd1b

SHA1
ab1fef014f9df272f81bc8194e98dc4c118c5584

SHA256
86b728d9c166cb63a46f2e77ba38feafa764a50228d4dd6796122adea0ca3169

SHA512
a07dff8f6417281e45343fccd756e200173732242e6073fe6c45543ebf8956a174147f313612b77dfd742b07640563547568a9b73cde26e7339e08e8ac3604a4

Download Submit