ceeeb8562d0225f46df8306f9b332e12747e3136383bd1f405a27dc62795f094

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
17-05-2024 00:34

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4dcc83e8f3403d3b00752ad9e249e44c_JaffaCakes118.html
Size

55KB
MD5

4dcc83e8f3403d3b00752ad9e249e44c
SHA1

f30c58f8e7ba5253adac0fd1a1166f95c848bd21
SHA256

ceeeb8562d0225f46df8306f9b332e12747e3136383bd1f405a27dc62795f094
SHA512

0a4464408bec8cf16a8ec8c72d70ee1169c466632020e16410db8b70a81a0114e9cf061855affe859850ab2f637dd208832f5f9e79d543a273bfcf5edbca47d4
SSDEEP

1536:8wZTfT0y1mENfRQdP5DUoeWAqU0UQsedgFchwV:BT0ugNU1qU0UQsygFchwV

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
568	msedge.exe
568	msedge.exe
224	identity_helper.exe
224	identity_helper.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe
1696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe
568	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 568 wrote to memory of 3960	568	msedge.exe	83
PID 568 wrote to memory of 3960	568	msedge.exe	83
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 4612	568	msedge.exe	84
PID 568 wrote to memory of 1492	568	msedge.exe	85
PID 568 wrote to memory of 1492	568	msedge.exe	85
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86
PID 568 wrote to memory of 4840	568	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4dcc83e8f3403d3b00752ad9e249e44c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc65f46f8,0x7ffdc65f4708,0x7ffdc65f4718
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4528 /prefetch:1
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,16478960747839081572,10895977171613648264,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1848 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1696

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4740

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
7e7b63d9daab4f02963bb9a96fef62bc

SHA1
5f26a0087ad53cee661715ab6fd040d22917d3d3

SHA256
4a6f05110f0687f4dc67b9861640ff72fd61412f5ed43b2cc306db9016da9d18

SHA512
e8d7705ebf2bdcd3b71753f502bd2e6495e1ff687d54702b408ea88001fca5db8f3108a9c69deb99427c92b6198de3e75227ff4e8c0fe7de1f52364ccc5b3dd7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
934B

MD5
3805b0e36e4e746ce99aa0715ed85c08

SHA1
0b11d2c3790c0379bc2ffbb343dc9c83090235d7

SHA256
a0d705da784faf05b78fed2b346a68cfbafc33891bf6349201a71439a1bbb879

SHA512
9b69757fe0e32a32d2c9b6e1235ec2516d87faf2903e0e0ded767421a574ac2f68aa3261e4f132e961889b3c3cc1401f1f0125dc5c8a1de78efb5e70f04fd465

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
902B

MD5
0689b362f47d1110667d234b99cb63d2

SHA1
b39a8448b68d241efeed13968244f06c4640c847

SHA256
13fcaa3b1b2ce2c8e22595475ffb344c2db54697eb3f524782cc917af2ed6733

SHA512
a65d27fea35b6357ae2fffe9b0447b04b26ee087d502dcc14688e475af73a00d6d66147d520ba595b1d08bdbe275290f123588e8832cce8f93611691cf00b0d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e71010d0d36ed74e5591f9efd744bc40

SHA1
29cc28c6f26897d65f5a09ccc2b5c72e90af50d2

SHA256
39bcd80d70fdaa3f7076128b56838500c314bbb93d04b9236b4327e2a5c2fead

SHA512
2a332aa024d4c35e7dc357dc5e83faa6670742d2c433e987ee6ed978c25b0f5eb2bee1fcc02d26336e731257fcd16a22aa586c0ba25fcfbc1bd59fd1462065bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e5a8a104d3be43bf678a7a8d849363ed

SHA1
f0608ffe1ec5202e00d069bfde91fc57a7050c4b

SHA256
cb3ef8d68a516bf8f67d9f08093997364808fe85429a8365c1cb9348dd89b172

SHA512
00ba1f7cee52e513a661d2f40866d2aece25d0fa07c4356631274fb6118f798652605592cebdceb23445a11104d1bf6ffd2d736832458eb4f3c4ecd39d600c4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9b3497202837bb3cd8d3fe2c5aab9907

SHA1
1d3aff1405ab392f3fdf15a6391883c4c4ce4a78

SHA256
164fb392bb40d4aa95c8222d352edb943e0b811932238ef6c0d7e358cf79f58e

SHA512
0dfe0bb5fbb6308df9b883c0eae347afa00628b407b9884eb35aea4e48a39bac6d18103b0eb409bee284bf44cbd015de937e25a46689d7e259b0fb10792d16a4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a453b432a426ef73f82b78cbaf9b9c93

SHA1
30a82ac8103855ab031b2cc6ec2ac431f02981c1

SHA256
3e8d826408512e6cc82592913d45b826d31e343b5671e9751b543dce94ccacd1

SHA512
4eda81b529cf74c6500969bc26b07cdb39f694a86bfe461acfa25126c3cd69949e2398a130080ad86cf7e3200bf3cfb63b23d63eb82e5841b6400d7df5cd35b9

Download Submit