04955877662e361273e819198482a3311992035b91f63ace5b3c1c4d1d2082e0

Analysis

max time kernel
148s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240910-en
resource tags

arch:x64arch:x86image:win10v2004-20240910-enlocale:en-usos:windows10-2004-x64system
submitted
25-09-2024 11:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f5e0081b99ea75e34cb6c1d60eaeef9f_JaffaCakes118.html
Size

175KB
MD5

f5e0081b99ea75e34cb6c1d60eaeef9f
SHA1

687de9c43c6a8a437ee2df2c09bb4fdf62057fbd
SHA256

04955877662e361273e819198482a3311992035b91f63ace5b3c1c4d1d2082e0
SHA512

ecdb49e59f0fe1fe3c0f516bf131376ce09918f3c8f72c9b6f1fc7a25822b2c200d4932220fde57ff3497910244fa6b37dd2b980cae5130bae827c857467a3b5
SSDEEP

1536:Sqtd8hd8Wu8pI8Cd8hd8dQg0H//3oS3uGNkFpYfBCJis2+aeTH+WK/Lf1/hmnVSV:S4oT3u/FMBCJikm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
652	msedge.exe
652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4636	identity_helper.exe
4636	identity_helper.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe
6000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe
4652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4652 wrote to memory of 2648	4652	msedge.exe	84
PID 4652 wrote to memory of 2648	4652	msedge.exe	84
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 3416	4652	msedge.exe	85
PID 4652 wrote to memory of 652	4652	msedge.exe	86
PID 4652 wrote to memory of 652	4652	msedge.exe	86
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87
PID 4652 wrote to memory of 4608	4652	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f5e0081b99ea75e34cb6c1d60eaeef9f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0bef46f8,0x7ffc0bef4708,0x7ffc0bef4718
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2880 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4728 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4008 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2088,15904390783200347382,18011328763719848111,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5160 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3120

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4548

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7006aacd11b992cd29fca21e619e86ea

SHA1
f224b726a114d4c73d7379236739d5fbb8e7f7b7

SHA256
3c434b96841d5a0fa0a04a6b503c3c4d46f1c4e3a1be77853175e5680e182814

SHA512
6de169882c0e01217c4ca01f6ead8e5ebb316a77558e51cd862532dbf9147d9e267f8db667ff6e9fa33164243724f5e437cb882392382f3cae1072dadb762c1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b80cf20d9e8cf6a579981bfaab1bdce2

SHA1
171a886be3a882bd04206295ce7f1db5b8b7035e

SHA256
10d995b136b604440ac4033b2222543975779068a321d7bddf675d0cb2a4c2b1

SHA512
0233b34866be1afd214a1c8a9dcf8328d16246b3a5ef142295333547b4cfdc787c8627439a2ca03c20cb49107f7428d39696143b71f56b7f1f05029b3a14376a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
fbd56d45a5f15cae1ff0eb802961dea2

SHA1
08bfe3518575d688b6830fd3acb8303b58b3f17d

SHA256
77465b448fe7210734a0c9936f416cfe016417904c3d651d4771d62c842724a2

SHA512
24eedc3705ed5444689dab4b76b6795c59dcd133c9ea3ab825492d2412ef0ee918d24c3beb33f0c9c55571e0bc91367d3a24bb3eb8bd85614d0e5883ab341afb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9f35374a6a5e0908ecdbbd2051b94a73

SHA1
48aeaeb5c21af8ea564b0f97069118e9d4e43994

SHA256
e0199cd0c4a2a80391a56c4dc56e4680a62a4923f77942d810492cd0547e407b

SHA512
46f8fb5f4bcbc050b31f1419caec92acbf6b16004f5e6dfc52777f3d21db1f5235532d8d834d5cf50d340b77a8a56e142003c2d0604b2206f8d937260a820a32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9244a4edd1a1d87b5e445f081024844e

SHA1
d5a4140dbbfd4df54a3b3fcd2708d4cd082f5719

SHA256
372c99819cea59e788cbeae37b1f8dc3fc4f8fcc0253b0bd465d644fc39ecc93

SHA512
f86e36187f5a86ed4fe4aacc4e6e339ee268309979a05a1e911dac665e35a51deda85cec025c433047f09e8e1a27238a1294ac9851531bd3c8e23ff390e43f60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
fa5d17a02c2b93f1e9598b4e6f8908bc

SHA1
7683825a6ae89fd8cfd35e01b3724cf85f2472cc

SHA256
2aadef84b976d14dda41cf43b928a8892423a4c6777a2d3d758ad0137a33a49a

SHA512
812e7d6e1e471f4b000104ce122f83020eea9d23d69a2b6b87fc47cd73c0b5ce1553f88618ba73efa095c63549ce4ef12a69f8cbd455d924f9a30b3f2d402288

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d0e70c838b4671208e68f7abd765be62

SHA1
f5676876de8012718885837a8667b29540beaf53

SHA256
ab9b02d6a0d6fe6e6ecd15693c46f1f687ca4b429118268d07c763c24d693e80

SHA512
c7b51217a1151dfc3506607297dcdc6e457ca15c82d8f6ab1fc1e7e4032e7ee7e39c1c4571c20dd09f9a8ce5a0efd596055764d7f8d7819c73fd9bb556e8e3a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
cfc2aa747a2f6cd17a45951e8e2b720c

SHA1
ccdf004ee16a84b048e9449ca50d8969942ccf3b

SHA256
df8093cdda0a76b02205fc7ac80e57ee5956514fbf0299c51d2d85aab9e4ce85

SHA512
f7c311a9f11ff6b1a798f94963b0a0ad3c93646aa0b708476f837c0bca9f3b01dfb701acb4ff7bf434b684284429133b0ca69ac3344b10ecb15eeb40f1597e61

Download Submit