9d64739383ca87c3fbb95eae91faf07adebf3fe6cd54a9d5a96266da6e6379c2

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-06-2024 12:42

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

91d2c8b981815512724e5de12e33627e_JaffaCakes118.html
Size

175KB
MD5

91d2c8b981815512724e5de12e33627e
SHA1

43b45888be825da1d459217ec0eee55375b79090
SHA256

9d64739383ca87c3fbb95eae91faf07adebf3fe6cd54a9d5a96266da6e6379c2
SHA512

af1f60df7c60daa479ae6d010179d9c7e40bffe6ac86edb240d0c9022221732d54e524588e14a2452d8cb16be83a8381b8280b6660ef261d82f915b99e2630f4
SSDEEP

1536:Sqt58gd8Wu8pI8Cd8hd8dQgbH//WoS3pGNkFCYfBCJiZQ+aeTH+WK/Lf1/hpnVSV:SHCT3p/FTBCJi7B

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1152	msedge.exe
1152	msedge.exe
4296	msedge.exe
4296	msedge.exe
3472	identity_helper.exe
3472	identity_helper.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe
5412	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe
4296	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4296 wrote to memory of 1568	4296	msedge.exe	84
PID 4296 wrote to memory of 1568	4296	msedge.exe	84
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 4752	4296	msedge.exe	85
PID 4296 wrote to memory of 1152	4296	msedge.exe	86
PID 4296 wrote to memory of 1152	4296	msedge.exe	86
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87
PID 4296 wrote to memory of 512	4296	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\91d2c8b981815512724e5de12e33627e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaa37e46f8,0x7ffaa37e4708,0x7ffaa37e4718
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2808 /prefetch:8
  2⤵
  PID:512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2348 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5704 /prefetch:1
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3984 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3104 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,12150012330603966127,5798796175617812169,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4772

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
59745adbc25b3b5fe04f2f0a1eb84eb2

SHA1
3bdd33b4231822e2c7dfcdf03f88188d69c30f65

SHA256
e669c2ad5c9eeb431ff3715f02306d755cb2b1fb2da2d8facddf829b3f209fc0

SHA512
4011e11637716124186c32e9d0637fb05eca12d90b54118a30a1aa0bb35f16e0fbbf3dd9bc259404b06bf8a6376d0b587ab1c65353d8f0566e680a8d0ca2b102

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\wasm\index-dir\the-real-index

Filesize
72B

MD5
3dd8e586486081fcebc7f4cee16d2285

SHA1
ff7031584cc05cee51aa3c90a3e30ec648b0374a

SHA256
a936e757140b1d3b1ad59a19d62b0d7e5f66cce7430de309dd9ad8b05ed3518f

SHA512
2624d4c515a9906edb3452791254898802c87f7dd621bef4fef713471ac5540a7cbc0b51dcfcc58649f73da7cb3e46f31cec3679e5e11da360388e19f3c2a09d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e614e8f4df11d7309607b32e531baa4a

SHA1
4c2bb441d61b3988fca162145450f217595def1d

SHA256
8de5823ea17187409139f49a3dc44ce9a72e5a078d1bcb2fff526394c3850a71

SHA512
2865a2ab70b4b77a670a09222d4cee12907714093f31815b8c1c9a500bd7ff9932d42d0fd9039496ac579ea260305438d691fd45583dd4966d733b6192058ce9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
600e22c7955e7b7a00dbbd4d4dc56213

SHA1
13ff4d9c503931b2a0c7a4bef5a63c0d5aad7c59

SHA256
00a630a810064b41f65e8ea6f4586fb4b35b90c88428a8485e83452381a51d46

SHA512
7e9fea7c4323c57d3428cf015ae874aec2f58ed7ab9336db4289f1e043d0a7b2e5392bdfee0e1705de22dcd3443fcc631d8b87e05cb81849551004d1f8e72edb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
7fff4067192391771f4c073bbebc1736

SHA1
f5e5d4b96bc626b55d39d0e123273d10cbc229ab

SHA256
8cbd7a7d3d6c72f9070221f42dec70329ea6d3d444cf7c53438a4492a05f8589

SHA512
ba92794cc9f4ae28eecc85921e6833f4412945b9289eae2c8d9e5b191ac9b5dde4e225cb75380e15ece14bd5123439cb1a138949cee3428e44629e60377eddb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f363384b-79c3-4f7d-a458-0e67548c98a8.tmp

Filesize
2KB

MD5
0531e2b7239e77da50ac60b54caa4120

SHA1
13639c8259994a4d3036ab5170b408c264bc8dad

SHA256
48fda6c0fd02bea824b58fc68d2c92f6f620d9941c509d933dde2cd94a09aa66

SHA512
e6bad7e81c5c3244c2537637934f5155ec01ce972c8f6d260a6a1d8855ec8f1e89756986b6518202a0215e8c4b5f500ceb33ebab766344c05f99e3216f6a88e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
0ab4a17c0af45161ac7dff40c18ffedb

SHA1
7bafc760c9bd6e0e2429ed1f0a1c03683b1a20e6

SHA256
245d519d9503a31246ece6d14cdaf7bb64e0d3f51863e688a075688c93a8b826

SHA512
a4ccb90a23e4abfbb155d4abee851d385bd001f45cab9a30a067bc1298f02b2daea40de6fc5c9af892263b28d98d5f81e9395b01673cbb9175d0b26d72aff9ff

Download Submit