b9fc78e3bddf95972ead4a0f7618fe6a6715910fa74ae822450211c938a11b55

Analysis

max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/09/2024, 04:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

df741f12dc9304143c4362acdd82fcb1_JaffaCakes118.html
Size

65KB
MD5

df741f12dc9304143c4362acdd82fcb1
SHA1

6cfcfce9639b8e66f0d43a7d8e804a7cb3f5ad1a
SHA256

b9fc78e3bddf95972ead4a0f7618fe6a6715910fa74ae822450211c938a11b55
SHA512

3dddd72f244af8c2eaf52bb73835ffdb97a5401801335f011522ae60109942d73133d3d508d30a4efb4bdbf091f955960fc096484a344e006251ced409c3ce4f
SSDEEP

1536:K62BGOZOr7gBbvFDzCAA99xxllAAppxx99tt3oY3o+ImZXddBzQ1IpLCM9Ok7Quu:X2BGOZOr7gBbvFWo+ZFZ6tSOk7Qu2ovW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe
3604	msedge.exe
3604	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3008	msedge.exe
3376	identity_helper.exe
3376	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe
3604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3604 wrote to memory of 3892	3604	msedge.exe	83
PID 3604 wrote to memory of 3892	3604	msedge.exe	83
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 3176	3604	msedge.exe	84
PID 3604 wrote to memory of 4216	3604	msedge.exe	85
PID 3604 wrote to memory of 4216	3604	msedge.exe	85
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86
PID 3604 wrote to memory of 3948	3604	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\df741f12dc9304143c4362acdd82fcb1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdb12246f8,0x7ffdb1224708,0x7ffdb1224718
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4796 /prefetch:1
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5924 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:4092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2004,4529432583688906531,10872454355409670274,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:4740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:820

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4d61d5fc23e75746652d845cde8ac90a

SHA1
36825162a329ddc69a37a6fd2c60b4507014a04d

SHA256
eb0f24cba533f06ec09faa782701fd8b6f1253ca54cef7f63a1b4aa60218df5d

SHA512
46ddcf8ab41aaf6e49c646757ab2923041a186718f7473a54c17f6e35ee907abb062be937189ee5281e5f9ef9c398a9bcffc1747b860c2d2005da94f843888a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f45438d75a98bdda49f780151e7f2a7a

SHA1
7f0ff4cc9d3e0b10c7238f5065406054f2cf8249

SHA256
43fb4d3edd275e9db2f2a81b64243db05f1852351531de5427fa81a467bcb0c8

SHA512
86e11cc1fed9dcf730dfc3ea554e7e16c28df938d877b940da294c4181bd7b28331821dd7415e4db21501243f11de4c8da0b8a1595956b44b233f17904376aec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
182B

MD5
4e6156be729a4f65681a10847e3fbf09

SHA1
e033f0e00b5d0dbde58a987a4383d4d99bf7a981

SHA256
a97fb78f7350d3dde3804344efb6c1af5d481ff259d8c485e8cf8c4851ef87b0

SHA512
9767982ea89f85cf77879d14e11d1baf5ea0b0da1fe499a5897f30c966f4cd94368d93bd20cb3a2dd0ffa74c8957a6fd7fffe917f33c221edacf24b0be13e0d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b5e7ebd7119cd3acc6c0500c29cb4ac3

SHA1
75d9c53609110a6491fb760d606ff5599befd5dd

SHA256
6b5da8e23e71e11bf8389c020bb32a7f5511dba48033e0b06c43c861462a59c1

SHA512
89cf0829e52ce85c140f926a2ed8a6a4523229ca2e0be7e621d637b0d39fb5ee9a61b963c36a33437da70b0ea3a6d3bc75d090b3b02a420630fb8870d51a99f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6a9198791d9192b152c8b8152f48290f

SHA1
c99b97f1988e4e86f283e72f9c745c45f64be81a

SHA256
3304787665d7a8ca2d252c2408766f75a349b9239d066d98afbc50548eaa4ccc

SHA512
b14db36345b018535f42b9fb101cf032a3f48c09d0dde9103ae8480dfeca489455b8757f507e0e48567b8a1d8767c931277d2c44e2a5e2fe17df8c8b79d41249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5289b1514b940cf25fbcd35dbba028a6

SHA1
334484f43e39688cc2913ae886c7df24595549a1

SHA256
b905fc0ee698f46a2385c8cec1d02c9c8bb8331c9bd0e74ff3e8bee06ee6b5ab

SHA512
ee9dd22978c9e6d1d973646df591e22fa0485238aea4bb7ccff0fb8b323525c31f8a7b7c7efb292a7a4b5724660c43419d161dbd92c3fdf356b896ddfdb67542

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
38608cd7072df2bbc2cb9b300a52abb8

SHA1
091ded4f60cec4e4785db5487ccb9442713f79ad

SHA256
e5e20cdf253c0f0941f1efa5fd06d17b87a839365e65ef3371bfbd9908f07aba

SHA512
e96fee4f67c318d6ff9665d3c512e73aef7616192e214fe5ebe6fc27a852bce07cc1399955d91578a5f510788824d43161fbbb53f312227406d27e4466c9ccf2

Download Submit