a6a1d88e36fc812b6635fae02259e64ea54a6a875f110f56a3c2ee78eb4fdf43

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

f59b68355c2f92fd4e7fa580e4201a7f_JaffaCakes118.html
Size

45KB
MD5

f59b68355c2f92fd4e7fa580e4201a7f
SHA1

b42b847c418e0db0964827ed5d1824a10ce38d6c
SHA256

a6a1d88e36fc812b6635fae02259e64ea54a6a875f110f56a3c2ee78eb4fdf43
SHA512

383dcd1f520a82fa50cc18ae386690283141b992892b9cced2419c80f1031a609f173b30bc519dbe1d409032c7d35db1a16df9c3f1f168cf7d5ffa55976f1365
SSDEEP

768:Qn1V5tlnvJ208hyA+Bwolz2l66olz2l0oIscS37IkOiAEqE+8XtiVjNdED/4UV2t:Q1tlnvQ7+joIslZOiAjUXtiVjNdED/D0

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4700	msedge.exe
4700	msedge.exe
2432	msedge.exe
2432	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe
2432	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 5060	2432	msedge.exe	83
PID 2432 wrote to memory of 5060	2432	msedge.exe	83
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 3648	2432	msedge.exe	84
PID 2432 wrote to memory of 4700	2432	msedge.exe	85
PID 2432 wrote to memory of 4700	2432	msedge.exe	85
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86
PID 2432 wrote to memory of 2936	2432	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f59b68355c2f92fd4e7fa580e4201a7f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc359c46f8,0x7ffc359c4708,0x7ffc359c4718
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2988 /prefetch:8
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5272 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5008 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4988 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,6395235238184970718,13328967706757574260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1448

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
619B

MD5
646039947280c153b75cf3e0ab6155e1

SHA1
f0936df04c1aef699251a640b2dfce753e05a4f2

SHA256
47b9e453a27c5e3f25b609d55b99e74789a5f6ec9f20893ee0a80e7172bf177e

SHA512
e30cde5c90343b64bca649addb523ec7fb12a96774f32185e757822c24e1a92ea0829bd899d966ba872ec5331e100a2d9e6a89cf7e9fe19e1fcde28b5c39eb60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
51bbd8b01675d0aa2536d30bc2fdf9e2

SHA1
51733e3d3cf630fc0a903b30413e016049056bc7

SHA256
9fac3b86c6f6edaf606642626f4b4d7493cad001dbf132ce99d1b6055055f81a

SHA512
783e5f92450137de4375ab3b7603e4351f507fd6582488ddcd43644fe6edae3cfbee4710e8733198771069550af0512990d098e1c829ff369894559e425bac46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
81481138f90a76ecda85e2ade120cd0b

SHA1
ff22ca691fdf76e2aa0874cc7f4840b9cdd49c4f

SHA256
573205515f3efb4652b2fbc751cc04eb77bc7415b529a8f931ca928ba9d43eb9

SHA512
2e1d0cc7f5ee87a1b1485fa7be4d6921f37b8f8c292bdac7b82feeb88fd93edd858397b80c4dd3a21ef565f0ff56ece57f2e1461f462b73a4baab61787627b84

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5dc6e1d6d82dce10b745343bcd4812af

SHA1
31fde090d69ea8a4402f457190f8240a9f189eb5

SHA256
3b5e4126d02a38f9110fa75fee9d64445f5a73787c28abd3be783d2686337315

SHA512
2f2babb2b0df8b232a0efd9ffb77d7f3f7444e31dc6e34fd6a715a80225771f05b1e134abb3b7f90ea1cbec304addd8ce7f17f59fa551e3cbfac296122b48383

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6044f2018348f4d64eb478451e40f331

SHA1
75fd492de1e329899652eea80b7788e3e23b21bb

SHA256
96e12ebdf8ceec0b86fe6287042e6873232cdb6e80f5b0f97a72949b06f096e6

SHA512
8bc7bbe8e9d179a779263b6921def13f693db96e484a44519463ac1e21977663e763fe4adf2811403ed541cf9b635267ea95d17a0b4757f7bd4b85abb78112b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
1346a66c178ebf85a6d4a6dcbb21461c

SHA1
90534015f223d0e25d8ad65aaa3b118fd6659373

SHA256
2bb25736eb8f7d78f34c27a704df6c717d1fda7ff5f6ee16842a3b1f61042a25

SHA512
e2d0200d8c593bfbaa2173443dd073446f8d1dbc205d7bdfb10c2e214cb5226b8eeab6c7af54a3f81e6e9e883d39bbda80d35f5af825f5db40fee54eb4228b7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
538B

MD5
76d43215dbf0ab8828ae49f3af466030

SHA1
c168b3f5d55975196506df63b20c349848ef64d6

SHA256
50be4bf0a1a6d322b000b874ce504bbc37beb2de1dc7843d22e07d0cb257d284

SHA512
e90177670547e78b8c78b61d62f636f02febdb63127091007d0b169ca14f68968f224c9180fdccea1bd53986a1cd0e89685298d8593fcc53d734a6b163f435ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe589a28.TMP

Filesize
203B

MD5
f9c50f2118c2bbea02a6e4cf32cc6431

SHA1
b94e64707dea45e1ba133fde5d249867964c4375

SHA256
74b3966ebaa16c31cdab3edb3268d7776fe6a05a838b3b7252dc19c7bf650cbe

SHA512
abdca3719992ff8dc9329ffcef96c97795acd23aa24a2f76866c69b069b399e76f4c113619ffbaba4cf3d90e69223f41b28b178aa8fec9d5b8734108f55116b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e54d9b46e1f5c93e31284aa794b01388

SHA1
4a32c90739818af2afb9a4c4fadf23643f3a7758

SHA256
e1137b2d613b1d842c8f61db6da125c8194f099313142444e17f45e2d233ed93

SHA512
7880056f4915f36272807bce4fe855febb069501b0d70ced98eceecf93244bc431f2104c41fdbabded1eba22ed53e711b49096e7b72d1196b99674e4be815871

Download Submit