64a5a6fc8cc2d69cb796a20418f7b0e31b182cab2d37801aaad4a86dfef4b45e

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
16/05/2024, 11:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

4ad05c0ada2478cae1f7ff5717ee0dc4_JaffaCakes118.html
Size

31KB
MD5

4ad05c0ada2478cae1f7ff5717ee0dc4
SHA1

ab46c2f43f00c0eb0680a5a35a841f0a8eef3378
SHA256

64a5a6fc8cc2d69cb796a20418f7b0e31b182cab2d37801aaad4a86dfef4b45e
SHA512

6413697c55cc6e6c5679bd73ff829ee02dd37a52e0848ac85b4c5671606ae63a74272e5145bea9e327be8efea6d0d2fdb427b6d0386b9db7f6fa7ae6402ba0fd
SSDEEP

768:8mvXvV6BIxF7wxx9JKo7zFuQKNIYoOmjWDupIH+Y/p8E:8mvXvVuIxF7wxx9Yo7zFuQKNIFOmjWDz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1624	msedge.exe
1624	msedge.exe
2816	msedge.exe
2816	msedge.exe
4840	identity_helper.exe
4840	identity_helper.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe
236	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe
2816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2816 wrote to memory of 4092	2816	msedge.exe	85
PID 2816 wrote to memory of 4092	2816	msedge.exe	85
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1548	2816	msedge.exe	86
PID 2816 wrote to memory of 1624	2816	msedge.exe	87
PID 2816 wrote to memory of 1624	2816	msedge.exe	87
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88
PID 2816 wrote to memory of 1828	2816	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4ad05c0ada2478cae1f7ff5717ee0dc4_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff76e346f8,0x7fff76e34708,0x7fff76e34718
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:2284
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4976 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:2796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5808 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,6486384651290526554,4891719342866267072,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5404 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4808

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
330B

MD5
cce53e4a344a9351df45156c1d257f0c

SHA1
ce17f9b9bae56811183bc763c6c6d025586a0d84

SHA256
b214d683a1d9d44312d8c05a1cc8340209082809cd3548066d40b31ed42a28fa

SHA512
2ef981d4533f4f6e75807c481a585f743b3d57abff512ed51fefe255b715fb595d2b48ac37d7bb110b139ff412f6da198359f7bde0d33c6d156a657140d15d89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8e4625ee15d36e652867b5d37dbdf170

SHA1
2ce7adff709fa0aff1ecf677571f13f949d48b85

SHA256
4e16553a519d59e95b53641781d8e4a2f411a3b715409f7c515bd300d46ddd6c

SHA512
b60312fb5d21abbbd3fe0a2676f5ee8f6837d7204ed78e987f163fee8e6892382145eb508eeb995fcb2451283001b4ae4856a9626f02a56b4fae7d5a8d57139e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4c70d71e1fc48d59c711adcb06a30379

SHA1
6f114dd8599d0d705169d8e20a7916881990dca5

SHA256
7dcf69b0dfff9d33cfd063264043c883175aa094688e12e564efc218d4dbb972

SHA512
7a289cdc448ccf9cbe2adea1505d78ec825c0c887c5193aea6df9aefbcb2d6fa205ec120e323321aee12ce23e639ce5ab8096424a18cd286f3aa36aa73506270

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7c656584bde3cab09102448bf8654c2b

SHA1
47ad70f077eca34c7ca8a5ce0bfdfae79747b685

SHA256
81f739f740ebfc3a4652646921dfec41523063a4d143511bd955e8f4138c2170

SHA512
ede90d0439b09a5001b86ce0338ba09ee3a43ab2f7b4c57a37746d2d3c2b945f25353d88faca9f52a335638a6f86533c0433768fe7e503e885cfd3a2fbf344fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
33242547b931a567d98d216b82a24096

SHA1
3624c97e6de94a67104dd946cec64bdc62e5ec07

SHA256
3bf1dfa7243e5b6fa811515a0720435d07553242f442da3cfe4baf44f7cbd354

SHA512
f2f6877af7fe0e4a20d972d2f259a874ac62c3985cbd162a0389a192e4a563ed48699355329262ab0715380e98d7140e16f1ffa489099f4022c6bbd524e8950b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d726.TMP

Filesize
707B

MD5
e1e63b48f6b9718782d0670c9ab96c14

SHA1
11a62e00bdd290e9283fd49b65528b5a5f888f97

SHA256
2c119c670ae252a3e056aa3faaf533c1d02411b041881a72477030c9d4d0994d

SHA512
7d8f0a2af88b0c1942071810ef7cb5913645fcab3f3ba9f96924517b7efeee4ce30712561e4836540bc4938afba97f6b4c6f37773b7c30aea1ff1438812027bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fbb1f2e2-d72a-4441-b3b4-abfb902bf00d.tmp

Filesize
6KB

MD5
c9b3696ef95dabb02e90e076f5918c1d

SHA1
44c32daaa09ee56cad198d29582b2d4d012f3499

SHA256
3386cf1e6e099a06d57871c335068c604dbb826d490fd15441c9c94c3204b055

SHA512
4cdae460552c4c28640900e7397135605d4d1a70d52daa4c3d3beaa8070fe94c044cbfa11340c9b078aa2b473b271170dd2131ad381bc57b34f5233212c07425

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
59cbd53de8b3e511bff77599a5caed8e

SHA1
c608aab339a2f5d696d7ef6f56c59d8eff1f758a

SHA256
ec864fa64c8bc18fb5184109639ad8f6fafdea4b1aaed9d8d11d4683a590ebc5

SHA512
3dcadd9016eaec7c9729cda5d9cec96a2d4ca54d705469d376f238ba47b6d262d76add7049728c08130578ab3012121c185e40ce82f492d848dc25df598bf635

Download Submit