49cd861cfec95464cd2eed89d5fe423d7ba2946546a88aafd35767a2ec25c443

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10-05-2024 21:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

310c51051ec45ace549b96ca612793f2_JaffaCakes118.html
Size

8KB
MD5

310c51051ec45ace549b96ca612793f2
SHA1

00110f098f75614fbcd7362607c1c2d0869e614d
SHA256

49cd861cfec95464cd2eed89d5fe423d7ba2946546a88aafd35767a2ec25c443
SHA512

d2d1f0248309b6f356dbba10cac736c4987ded160c5f35fc3542e2cf7ed25fd09f2ba6910a8126e498f32a9c7be4b0b9b13b6619af1fbbfedea35ee9f1f94ab2
SSDEEP

192:4ZZ8rHX+SPnkTBWe3MHDBMS0pYiGko2cf3CsKob:4jbSnkUHHDBMVedkDcJ5b

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
4000	msedge.exe
4000	msedge.exe
2440	identity_helper.exe
2440	identity_helper.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe
2916	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 4540	4000	msedge.exe	81
PID 4000 wrote to memory of 4540	4000	msedge.exe	81
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 1508	4000	msedge.exe	84
PID 4000 wrote to memory of 2956	4000	msedge.exe	85
PID 4000 wrote to memory of 2956	4000	msedge.exe	85
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86
PID 4000 wrote to memory of 1260	4000	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\310c51051ec45ace549b96ca612793f2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb533746f8,0x7ffb53374708,0x7ffb53374718
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3120 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:692
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5620 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,1167531020361490724,9213730590794169299,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2664 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3392

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:8

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9d6541036cecc83449c5cf40d605e841

SHA1
fbee188e74e55555ee85728769a0fc6f9828f603

SHA256
0d7b045c8a6ddd8114cd12111ccbad30a79882dae3a2433077feaea32f74ccf8

SHA512
f390910c4a94631f33bacc50f2d94780e31c144cdfbdd9a01f1168e0105160b216771e2d7cf2a9cc5471934c970714ce479a754202db88669835d4c5442c80b0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
57c02ddb837e546d8da5e7386fb13610

SHA1
e52b9ed0e796e9e2675217e93d76332d2747c5e6

SHA256
fc15f2eefb8b982bfe22ff8bff1e9f7d33c96fbd1890d22c28fddfa07121293e

SHA512
ed0e9f118c10b3cdba1552afe5ab16882f7747595f042ac889cdec1f0ff2184331f3ed2dac54ad84b3822bd3a962a7caa168c78f1af358c2e9e132fbe65a63be

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ba1a2259c06bc9670e35ec1108ab8541

SHA1
879ba79d1f54d6a0928c1be3e04586b2075f0fa4

SHA256
9b230e6018b10d4e5f2f21daa715f4213a590225bcbbb8cab959a7e691eeb757

SHA512
9209eb15fe19fbef31d9d973d516bc093adca4cc214f2b0559828986ce45ff27421781b6cd997fe44df58c4a2b1f223e3b334f9310d04a8209b03295bd1db2db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4d35e9cdc7494b3356a529c2e92d4c97

SHA1
af7a6f83bca0a936a1a1317db781bd369b543858

SHA256
b82d83aaee16836ea1d5df4f5ba3a1563ed0ad6d8a5fa74b69ac27b21f20e2e6

SHA512
18a9efcc8cf5bdfb488b02ced3b1a45efa8831cdc0da74a3cbaba96e19f51d2ddc7e5a92aa9e7636396647a2f9a69372243c252b868319a675d680a583f79144

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b3ed40e0be4e4e5599915eb36f82442c

SHA1
0f0c29ee5f0a5245d4716ac64bc708ab4d07fb49

SHA256
6d310c8207da5c49d963721fed62bf7556b97352846be2747d0fe9b100e75020

SHA512
4bb784091d8e1682270974cb1a04a2c916a0618ca8c0333eb4a716bb3096d6c6517c75bbd6de9649c829d3a9e3c3ed418e1516a20cdb691c8bd01840faf69f1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dd196d844d171ee4c161c1d63e7fd065

SHA1
9c43e716ddb4a7e7819fc297decfe1a26e2e2465

SHA256
956925bcd0e9709a09bb21f883f48e61aa40483e9d7bb2876e7f6718532ec460

SHA512
ac0ab77adcb7dfd534cf29a4d413bdad16863f79c17d2768fd4d269ed04e938f7166c0ab1f77dadef991f58f01a3b0f85774174624c232b4602e9d182253edc7

Download Submit