fef7ec49717be691cbfe5c3dd2125a19c1a8d3250d27f97a6617d7fd027e0b16

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 04:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea8f73657989d8dbc1e18cda39806271_JaffaCakes118.html
Size

225KB
MD5

ea8f73657989d8dbc1e18cda39806271
SHA1

ffed3cfd6fae6e1f80cd68c29197e15320ba4215
SHA256

fef7ec49717be691cbfe5c3dd2125a19c1a8d3250d27f97a6617d7fd027e0b16
SHA512

45e2501902c8264b375027927acebdada509106ed42488df97117d76ed3ebc7df84e28c1d95f07314bf54d75a73c8fc2c762494026ebf3a844bdb402b4568827
SSDEEP

3072:IrGymOAcBWyeAcBNpBeNpbOnS4A6WVIF/MA2tF1Mjn7jyPOJQF7Zo:IrGyJAcAyeAcTpBeNgntVEMj7+o

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3416	msedge.exe
3416	msedge.exe
5044	msedge.exe
5044	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe
2832	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe
5044	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 2500	5044	msedge.exe	82
PID 5044 wrote to memory of 2500	5044	msedge.exe	82
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 548	5044	msedge.exe	83
PID 5044 wrote to memory of 3416	5044	msedge.exe	84
PID 5044 wrote to memory of 3416	5044	msedge.exe	84
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85
PID 5044 wrote to memory of 2368	5044	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea8f73657989d8dbc1e18cda39806271_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb53e546f8,0x7ffb53e54708,0x7ffb53e54718
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2484 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4972 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4020 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2068,2822505862663946725,3948701043825651722,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4740 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2832

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2880

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
970B

MD5
1a2b946252755dfd39f11a740a61afb6

SHA1
0950e0706ec10c8b18e121ad49fcbafccd1cbc46

SHA256
9c610c6c96b4bb2f98383678d97befbb576eb6433aa0274bc6d8e95323ecaa5b

SHA512
3afcc02d722f44221f54e595306f1d7b1afd5fc6dd5d81e58a2865e160df6dd99a08f9b35dc54693a9ccd75e4cf6712a668ec49eabd05955aaeb2bbfe3443edf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
456a2e72b2736545bd5f17ddb7e00cba

SHA1
a6c2121cdfcd4e4d0e46260cf7056f01f753a458

SHA256
3441d419059120c42a4d2b6b498809c11e2067357087b64bdfe1df45a65b713d

SHA512
78e84b5f5644f1af37af32b9bdb67eef446040b0ba4c2b8de4c82a04adfb58801e26967eb17c02e7d5d7b5c4bfbbafff5acc73d3260ba4c539d293f40c0a063e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
23d0bb14591d4766440e485c0c6609f1

SHA1
954bdff4ee2f106f6052ba1abeb4f86adf99578b

SHA256
a28fe7123cfc6bd1685f9aacf18373ffba90da46965ba28874a0bf3d03a6a3e0

SHA512
dabca1bcfae92f7a14b75584bbc7daef8675969ae8ca726735aeb490ec8967148722d04bf09d30005a0a37c4bb7e6c6df1f2d9d6550ad60173ac4b625569a8aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b84309bce7ce9c796725dec2e35f3434

SHA1
886fba0528e59169b23d6d328644c270401957b1

SHA256
978c0b7e4f00adec1d781f3655f4512e24bc08ad839c8b7c23609f1b4a6d8ce7

SHA512
8da08cd94b08b69d157e7efe1a6b5c24c8204f8a040906e02b367247a669deee42976a5f96bd01b608b66c32bd51af07e7468fc5c9819febd4f68e42cdf51435

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
173e795795db1139c30243aacd8035ec

SHA1
e529da07079b78e4cf937cf376b6103e6dfaf0b2

SHA256
cb78b9257d5e1e7b1ebe4d46802d79719b105c8cb177487bb061ad29cef6f4e3

SHA512
98d3f66cd8c52bb8cad4c34ba49bb18411967ac9ed310a05ab107eb6eecdc317b5d5e263fae27baa27746a8bf3cb9a6f6264ae3838e93bdfbee790055d65137f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
833c1b223ee461480435fd3e544c91ca

SHA1
ea373f3a21b6191699efb923f9a00b1d7b790019

SHA256
8bce033663762c735380b97b2eb9c31ec91bf04c1b97fb5b7167d809ddf76130

SHA512
0e59e5675c43f1f8e2da43ac35024873008ab886e635c556aab7c39b5e364baf9e25b1c0bb7eeadefa51465828ac0025aba462c1ddae85996c5bfa81384c1759

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe5834f6.TMP

Filesize
538B

MD5
7b6ff693049264c14913c23d050a6498

SHA1
d0654cdd3e6f4f2b87962cc5abe7367ab47fa8f0

SHA256
6f4ec3ca8a35844b907fb6de53706b88ffe3ba5124aee0c08f842d47abed5f2e

SHA512
1484bab57aaf212293c1d028435656746eeaf3e5e434b6e3342e212e898f04bbef0bc89788e96fc63ea1f5e2828e57eb25301cbbd836684da7cdadda42329c8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
44dc7d4205dcc3bdaa8e173fc2e35ea1

SHA1
13041b44a4fa5fa694996c50ef5833c59a3b4b07

SHA256
f5728d70aae4b1b060314eb7640925452b54b8a691b0c2bf833cf17f680d1006

SHA512
e26ad08e554e06089d5fd5d2f08cd1265418111c0e823acc49c6842996b1f8ba50d55c3990bd4a9af245db438fd22ee36fcb3d7b8042f0d39ff4678bb5cb6fe3

Download Submit