0376634cacff31c25d7a48454d0ef1fae1162b2988941b131110ec7f883c3035

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 09:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fe4140afffa0fb74552b4798143ec72b_JaffaCakes118.html
Size

175KB
MD5

fe4140afffa0fb74552b4798143ec72b
SHA1

9ef5c98ad8d21990d361c30017c24703c1bd8c2b
SHA256

0376634cacff31c25d7a48454d0ef1fae1162b2988941b131110ec7f883c3035
SHA512

b076d13131b1a55a277eba0887fe163b8a4525313dbb060e3b1e50fae69d22baaf44424f9a5db526b3d35635a16b93492f836996ec3743315f167bf26b80aa46
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3NGNkFUYfBCJisd+aeTH+WK/Lf1/hmnVSV:SOoT3N/FBBCJitm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3188	msedge.exe
3188	msedge.exe
2628	msedge.exe
2628	msedge.exe
4428	identity_helper.exe
4428	identity_helper.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe
3904	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 5040	2628	msedge.exe	81
PID 2628 wrote to memory of 5040	2628	msedge.exe	81
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 5060	2628	msedge.exe	82
PID 2628 wrote to memory of 3188	2628	msedge.exe	83
PID 2628 wrote to memory of 3188	2628	msedge.exe	83
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84
PID 2628 wrote to memory of 1404	2628	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fe4140afffa0fb74552b4798143ec72b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab96846f8,0x7ffab9684708,0x7ffab9684718
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2208 /prefetch:2
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2472 /prefetch:8
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4784 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4104 /prefetch:1
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5060 /prefetch:1
  2⤵
  PID:488
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5820 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2336 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,9014154252616652850,10326283710324821084,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3904

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2700

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
074384ef179099b8edd3de98cddf84a3

SHA1
1d22ee3fe2ecbda0939ef8424a167a3a6f7d0aae

SHA256
eba63fbd83dc4fc529e28092b2cba160ddf9064278b41345b6e6e05da90149f2

SHA512
1557068ed47c0345c87be7d15ab3d1624a097678891cd900c6f800f6a9b5e99f8ada74bb98067b9438a77ee61af90f7cf31e218b1034b8c73f18ec4d8262ea2d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
95db38ee6e793a08366ce09f2e039447

SHA1
e388aff6d9f5b412800096254ccbf90de6a88846

SHA256
29d215af837715c318da88c7ab94428870f57c6e89135b18a253ee9c694677c6

SHA512
c23f482824eb0a1037cda43218b9a5c071c58765a5c202fa4e8e5e418e065db00fd40548ed241467064b0ae54e7a1e351b805cd995d219a58945aeac9de4d736

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
77827775debff3da73b4174b5f1a7146

SHA1
64e6ecf41d95f69c291e6cdadb075f29fa6f25fa

SHA256
425c7d2b8de3e83550d270e41cc41b5d4c709319eb1afb432b108f9a130f3753

SHA512
ae523c7977042996c974cc32bf14b0ba8f77ba67fe57356221de46781545bc9936386e103081750dac348bc60f4f8fb6918ac9b5bb656316cdcce1f4d8cde578

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
25704866ba7433f1288f58272f68f5a0

SHA1
14d832121eae3afb8b4becf08dc94a4ca3250f07

SHA256
9d9156c3af1e60d2d3860d9f1c6d3e215fbf96f256122307aeb423f35abd2499

SHA512
0f7ba568559fed7b70ecf2d672f5cd15ec71b81ff421e2ccd44efe4a78b3243b6937b9e5c0c8d808b441055e7c34012e688ff8dcb379c5f1481385a7b02c74c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b455691b1f26e7e9326376a4758865ee

SHA1
14b34e6c439811c310b4b98c00b7c4d1c3a3f5a0

SHA256
2f3030bbd27b5a8e2e8d2b7ea0f066e9a4de36b86625ff287eae31b0430e7b46

SHA512
86a0a72e629e7ae90dbaffbd9e3fcbb49adabad0411a4ba849067177dd4a067df3b46b1a0c1d38c5cd8ac4031e987b6a950d98babd269ab39f7ffb2c4b9108f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
026de8c0f6b2937911b0db7b1c838693

SHA1
a6d06797d9fb17d6c65559722606594accd0cb03

SHA256
508af83958b89ba4767f792604bd82e06cd508647a9591df5df950fed06f4259

SHA512
0472b8c10e503cc1fe1a09f24988efc2a43cf0aa813b2010698c9b7e67354adf12e95a7552306ce9fb48b5073eece850ab9edf04aa66b33514e99d6f2e1c8ab6

Download Submit