3056c537c58c3a88fd83012c4b4b48b91737e7f7de4c578d422e614251e95840

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
08-01-2025 04:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

JaffaCakes118_8b33c53eb41448dd27e8e74c156b0f91.html
Size

175KB
MD5

8b33c53eb41448dd27e8e74c156b0f91
SHA1

0d418340241fc77cfc1e50e0479b968a6c2f4a35
SHA256

3056c537c58c3a88fd83012c4b4b48b91737e7f7de4c578d422e614251e95840
SHA512

ed90941cfb645fb33125fab2c42a29e63a4d6dd1477e8ccba501eddc9c8cdce72c6793aaca954ee5856511bd96cda6f91c0bb4a58004601824d45856b722de4d
SSDEEP

3072:P0xjt0G8qxAGXmNJUzi64WvP4yvRJ2TVZG8lDCv5C+zMhY07FR:PCHXmNJxxT

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
64	drive.google.com
56	drive.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4084	msedge.exe
4084	msedge.exe
3872	msedge.exe
3872	msedge.exe
4424	identity_helper.exe
4424	identity_helper.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe
1388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe
3872	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3872 wrote to memory of 4204	3872	msedge.exe	83
PID 3872 wrote to memory of 4204	3872	msedge.exe	83
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4768	3872	msedge.exe	84
PID 3872 wrote to memory of 4084	3872	msedge.exe	85
PID 3872 wrote to memory of 4084	3872	msedge.exe	85
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86
PID 3872 wrote to memory of 1444	3872	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument C:\Users\Admin\AppData\Local\Temp\JaffaCakes118_8b33c53eb41448dd27e8e74c156b0f91.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffabf6646f8,0x7ffabf664708,0x7ffabf664718
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5312 /prefetch:1
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1320 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:3548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5256 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5784 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2188,14293210337499119288,15222937976652858286,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4808 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1388

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1620

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0a3fd8cf-341d-4c67-87c2-9302d6cda2b1.tmp

Filesize
6KB

MD5
6984281c11d54c0ec6434b7b05c3c35a

SHA1
849e134425ada005adc2027af30cc9fe2bb3b44e

SHA256
74bc6ed155a9b55695c1beb5853daceb1c6c48b2fe0ffae45d3de6e05f9f54bb

SHA512
34a57bfdabd2a9eb27e0498a8e5af223ce9f794d085bb609fc61ebf69be57bd1ab329d4d155cc82fd78e9917e1662ed2ea7d5fb85b7de4ea0a53b8e69eb48b91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b8d6ce598d5cf96959ec51727a2e68fc

SHA1
ed787561b63bd521745f4cfad12cf66a093ea1c8

SHA256
cc91f85cf0410fd218bf4e2c330d46bbbf8333696bd3bffd779c1d36ec7f0765

SHA512
a19d71f330c46c07867f98ac53d5c31cc4b796ad241a0d6d1e7bac962cdb361b646292aa2228ef8cb013ddfd00452833baea69c0e575779c959dc48bac911c8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
bb829bb4d4cd89cd262707e8a160b21c

SHA1
fa15febf622a334e08464cf7057733b9107ca821

SHA256
4544e96bd9077742acd1fa7950e305aaaeb489e60342d466719c9592be3295f5

SHA512
95299498d238b01a52f2fa5c942155f37f346228c77d1c65ac4f89db919c17d33653fda099e6ecaa02fa39d4f30426c33b30a43796bc5563d289cfbeb9340c92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
689e48463fb59c7a590239c4e39d0faf

SHA1
8f5c3e7c6a320f083f485c504cf0e52d29ba92ec

SHA256
8098ce66b202c4230e8dcb6d9d8ef792dc1678e7021cb1b5d5ced85f8425dbc7

SHA512
065c118ec8067a5a37f9be6b6592f4a25754f08d492344e5b1cc8c9467e354a2bb67477fff33ff61712ede6eb3ba50e12900843b5a9c8a15ae138152f542caca

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
51c61a018c46e6e33ca3bf113fe060ef

SHA1
c42e1b488f094144e4de02fba96ba4768634c578

SHA256
a72b25fa9ce66e69d70b9017ff94963d34ae45d5dc264b6f32a1903146248aff

SHA512
851e65604d2b0dfd9586dee5b735c7379b7ae97cfd646d9c5b010eedfea254b5e6c7a62208db001609c91164d81839a9a675ab94d68d2236efc39c7ebb075e31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4a203902945082c40b71b055ec53e198

SHA1
59acf0633ff0d2d7328968a44cdd5015110e872a

SHA256
ebef20390c575be0fa3ee4767873f72a2c7fc45b606fd7b6ad4cf7e7daa9db7a

SHA512
49d0c481c21053e4bcec89e09ad6e623c88269031cf82dbfc3fb82136feda153f953d460bdd08db715dc2c54db29de7b61223d58519516ec55073854107bcca6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
508202a0b0e81056e440315c9cf845d7

SHA1
9c3808bae49fa8ba14785c7b43e185a3759cd812

SHA256
121fb6ddd6772357ae32f5354712a56338041d09c1ce800bf763b7e89e98fb84

SHA512
feef76f4b876a7bacd25d6a0c182a7d71dc69b25dfad775177b821d62e2c3b43cae3509a05470e613e7896d99916f7f8cef0ac49f1a892906c4cb624300e8bae

Download Submit