8494dc11e9c0054679416c2ec18e730bffe670c45b2747b9496e0fe496c9795d

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 19:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b07ec1cf5b7cef92f8eb175028fee976_JaffaCakes118.html
Size

55KB
MD5

b07ec1cf5b7cef92f8eb175028fee976
SHA1

c7b60d1cc9c7e94a0ad35334d9b0517f18e902e9
SHA256

8494dc11e9c0054679416c2ec18e730bffe670c45b2747b9496e0fe496c9795d
SHA512

75977fd7bda467333fa8ecca43e9f642723b4672566aee60ee5e425dc9f094536ba7cee75fe9c8bb2bb344a92c891313224a3ff0f704dd537a4a9dc97bd3d4e2
SSDEEP

1536:Sy3HH2ldtZFrhmEwR+915Y9rCX7CePAKsO7CQILzfNd1/FN:9HWFncZI91G9rCX7CersOunLpb/FN

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4040	msedge.exe
4040	msedge.exe
4752	identity_helper.exe
4752	identity_helper.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe
1028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4880	4040	msedge.exe	85
PID 4040 wrote to memory of 4880	4040	msedge.exe	85
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 1952	4040	msedge.exe	87
PID 4040 wrote to memory of 4940	4040	msedge.exe	88
PID 4040 wrote to memory of 4940	4040	msedge.exe	88
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89
PID 4040 wrote to memory of 3580	4040	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b07ec1cf5b7cef92f8eb175028fee976_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce49a46f8,0x7ffce49a4708,0x7ffce49a4718
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:3580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5644 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2168,14729373091156815795,10029209714702717049,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1728 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1752

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\74d3f84e-19bb-4233-a517-34b439818944.tmp

Filesize
7KB

MD5
01b6f99a11ecb94f92fb78f1bbd3f710

SHA1
9cf6e85dc23abf22508745b679d0dc3dfd476888

SHA256
013ee9d988456505f0d3289eaff3f41cdf9a73efc9b24db6bd804e0b760ae887

SHA512
13981bb75de7551c5893644f0a27bb3a3257738a3600c6abde2ae69041f2e5ad7162b456af5019a73787dff7501f0cec805dc2d1fa59604ee5c6e2d6c6c48ba2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
701241f55e4ed5bbca1a6e938a4916ab

SHA1
274be936214e8e91db938ede97b1b6fc7932e326

SHA256
7e1f71d51e41f44f71eefe39015b3148f8fb9a3f03d8f5fea9bf01c30d67c748

SHA512
6f52ff907f3cad774005ecb21023a5fde4599fc2820ccd26496ec4356471549eae16355eebab7a4830b7b3bf48fc43343650abeb5b36a209c960bab937893f69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
179c4789d2ebfaa59c51d6135c8e9461

SHA1
5d99efaf272be3e75b3f0ae168f4ff3882ffd67c

SHA256
03ed6ff020336310fa7845f9ca101b5012ff7691524d1fed657a71563c6d8c0a

SHA512
177e7c6aaf86084f05db5226df37c0ae4e2cf7de0e814daf4412f37aa721cf8cf1ce8c9bc78a475a5fafb80d71726f1ddae425346577883946314422e2c692c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6fef07a690fe169a41ceff2ff7c6c719

SHA1
ea06b287433adc3588397c490bb227c12a7d5491

SHA256
1c030850997b2f619fea33c8bb120898cf68ce0d8ca3c89d9e13e1f8cbe0f1c3

SHA512
9d42c052c19394968d53d5585a3359ec58694b4a164108fd623097c14b0782ea3d4b6da37c4dd149a7dd04086a659b79e9a0d3d8d101ad36e0ebbff2e69d910c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8e2e9c881549633f805d250983ecb02b

SHA1
ed0344ee804281d533d56ca2c39e9dc5c75f1799

SHA256
a9bb5f6eb7d0181ea3996ec562eddc0d54b8d03c1d56c1a0783be809b6fd3876

SHA512
ef340604faec457cae7879432061a394e8d03b5fb874bec159b318e51b31a43880ed5c5245f02ec5e71ef268ed32c18b18e45ac542f4bbcbd1f0413c05170282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f9b96267-a4c2-4f1f-8539-dd15c2223ad5.tmp

Filesize
5KB

MD5
d12b1848f55740a46e7a3b7e157282cf

SHA1
2eca30d8209451351ca18871423eb6b6b8138988

SHA256
886dda5963ceedbe1c5c157569a2c78aa2bdb3647eb139b06e5d21cef4f15068

SHA512
48faf1c7be17be1663837580ac9cb69dcbd78ef937e7aba2dde29948484365c89b4aaa1f1d1c65a82de647dac7ea565a442c68a8317a2132a0775e737ab57404

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b4f328ca228b34bd57f3697eb8a71407

SHA1
d2a7df1b8eeafc835c0745ff04828f8a9f9b206b

SHA256
264e1a43d2be78eb5e25e3a7c710741b2d2e3fb0f625432c0d17056e6e8e03fc

SHA512
3cb587dc678ecda34baa55500f7250d696d22283dc082defb7905d92a1a4053b10710c2dce64fcaaa384dcfb456ac628d945e6c4dc055e107cec05a5ff2b43ca

Download Submit