197dd8c47f9e7c29a180e3f0b543bece1a8ce11243409e611e759334afb9331d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 08:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ad97ebfe17e93100d2715afc3ca96e71_JaffaCakes118.html
Size

1.0MB
MD5

ad97ebfe17e93100d2715afc3ca96e71
SHA1

74e3eb47917a0a71d4025aeed478fe528aadc26d
SHA256

197dd8c47f9e7c29a180e3f0b543bece1a8ce11243409e611e759334afb9331d
SHA512

9cec252b85bceb39c9f441bd82441c3b8a4f8312c1c105f08ba745f5be3c8479ada0a31ce9941d999561d86d6ffc0042cb3d8f652851638749f391a62db1927e
SSDEEP

6144:2kcly4UQ6Y/JBDRl3LHhFKB/SKbO6/lsE2HG1qxt+GPaqFZV+rW1bW/:2kclBB66BDRl3LqBZ7xq/1m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3204	msedge.exe
3204	msedge.exe
3096	msedge.exe
3096	msedge.exe
368	identity_helper.exe
368	identity_helper.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe
3096	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3096 wrote to memory of 2552	3096	msedge.exe	81
PID 3096 wrote to memory of 2552	3096	msedge.exe	81
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3132	3096	msedge.exe	82
PID 3096 wrote to memory of 3204	3096	msedge.exe	83
PID 3096 wrote to memory of 3204	3096	msedge.exe	83
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84
PID 3096 wrote to memory of 5248	3096	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ad97ebfe17e93100d2715afc3ca96e71_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc825c46f8,0x7ffc825c4708,0x7ffc825c4718
  2⤵
  PID:2552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4956 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:5836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5324 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5280 /prefetch:1
  2⤵
  PID:5416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,17057081365210689605,3363331368199981654,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4852 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4052

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
93b9e40c94dd1f80c9e4874be62a779c

SHA1
c3a365ce835319c877cca1474736692995653484

SHA256
b552d2e52a612cee6bd6445cc18bde617835aae5060cffc84eed99bca62d9b8e

SHA512
3535430c5a8bf4194dfda735e0acd35ba2344063a803b3429436fa1e9287b9525c4902a33a557680d7ea9446d5ba1250179517a33a43976955d869906199c316

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
da25ae222d47dcd4c37e94928d466997

SHA1
2edf57b85cbe9d466b474042e89a1748b72832be

SHA256
01305e9c9c8213bf7cc0f8f0e0ffaa5238a283b36b43b0c20129d70fd70805c9

SHA512
eadc01bc24991a4253e39938209bb537a1fc91bd4e04ec22eaa355a8b7895373f78ac90adc63a33e2891d6656e50718020eac0fe5d8b70741625cc635e28fb15

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
77fae743b1146fe7fc14352712f7387f

SHA1
4843dddce0d84ee87f6786301f9878318dcd2793

SHA256
2a28534e5653b46b67169f05b6b5af3fc648eea6fb1190e846912ffa12229eab

SHA512
87324ddc9ebada42e3ba5b63255c26ff5db3c83bf2ed676bc1404b99c8390f110d2e48212d1e76a3a6e53954651dc643a5aa5b6fe4110186382903c78ad58a00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0a3be35b73c9004268bd3b07f44c1e85

SHA1
27e44e8ab37671908f3f8a7412d606a18f07adb4

SHA256
102f9bf712c65c2cb657da6cb70370289139579e541eaab89812ea9deed97c21

SHA512
307ac5ee93e3f004eb11a802c42ade0a1b2103a3ad17ce41d07ba438e2100742b9631ac3abfce21bafd21f2d39c81d4539502800ee02786b8e1c057605268403

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7367107e6f61a9c67090465022dfa20f

SHA1
51d9366f5f20ae9c65ce4103fb95248f980e354b

SHA256
9fcdaa66cbdb9e1fcd0efb3762727dd08cd1363d243c1897f9a0deead7813ce4

SHA512
9a10eeaafac5daa5c4801de4925d5903223fe399fb01a57c9bb59a7c974d00a75c45b3f925a36e1d77e233088b270b2598a7d6ee0a289d60c9861523e731dc0e

Download Submit