361f08a2d6e7fb90ccdf5d187d8f85f82d319b07f8e302431d4fbf9db98a9b14

Analysis

max time kernel
150s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13/10/2024, 04:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3dcfd9de889dddfaaa08d56cb54fbdee_JaffaCakes118.html
Size

32KB
MD5

3dcfd9de889dddfaaa08d56cb54fbdee
SHA1

a5b5ee3939a1e4dbef933e26138243043d43adfc
SHA256

361f08a2d6e7fb90ccdf5d187d8f85f82d319b07f8e302431d4fbf9db98a9b14
SHA512

3a5cb41d683b31646c3ee3880a8381059b68a503cb3f6061e4b65f720a04c979f54eacde20e294cb41e41c6ea395c6a66d026998aada85ebfcfe36de1d928053
SSDEEP

384:ZzGj0seoCeeSGDA55YNQud+uVehKWEZ0QyzmBjXZjwhgJVYPhAw8SmNf5d5vPBpP:ZSjajTDRNQMWRUXJBJiPPLu/6y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2656	msedge.exe
2656	msedge.exe
5052	msedge.exe
5052	msedge.exe
1684	identity_helper.exe
1684	identity_helper.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe
3364	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe
5052	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 1340	5052	msedge.exe	85
PID 5052 wrote to memory of 1340	5052	msedge.exe	85
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 4660	5052	msedge.exe	86
PID 5052 wrote to memory of 2656	5052	msedge.exe	87
PID 5052 wrote to memory of 2656	5052	msedge.exe	87
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88
PID 5052 wrote to memory of 436	5052	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3dcfd9de889dddfaaa08d56cb54fbdee_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa98a646f8,0x7ffa98a64708,0x7ffa98a64718
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  PID:912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4960 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2152,9895343860891272159,8522512067407411398,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3364

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2536

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:512

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
99afa4934d1e3c56bbce114b356e8a99

SHA1
3f0e7a1a28d9d9c06b6663df5d83a65c84d52581

SHA256
08e098bb97fd91d815469cdfd5568607a3feca61f18b6b5b9c11b531fde206c8

SHA512
76686f30ed68144cf943b80ac10b52c74eee84f197cee3c24ef7845ef44bdb5586b6e530824543deeed59417205ac0e2559808bcb46450504106ac8f4c95b9da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
443a627d539ca4eab732bad0cbe7332b

SHA1
86b18b906a1acd2a22f4b2c78ac3564c394a9569

SHA256
1e1ad9dce141f5f17ea07c7e9c2a65e707c9943f172b9134b0daf9eef25f0dc9

SHA512
923b86d75a565c91250110162ce13dd3ef3f6bdde1a83f7af235ed302d4a96b8c9ed722e2152781e699dfcb26bb98afc73f5adb298f8fd673f14c9f28b5f764d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000005

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
a621c32954501f41dcadd9397f8ac541

SHA1
8fa9f2d68e3391a908178e3b3545e3f330b4d515

SHA256
10e56b63629f44c3edaddcae7250bad02d85f06e4e4a1a2fc2789cb338fb4351

SHA512
d51a5b203817cad986a840c599c1856ce34a9056ab2e2047f1e3762cfd89c3b06a1e40824b5873765810229d039fae23b4fd6ef12afaaaaa8f61f503fdbb8d7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
484b6057bbbe2409977d9a449191190a

SHA1
0ce4def30b20ba49b61ca963732bb1589be30852

SHA256
40200bf366ec3c5d8bbd8c948e1807aec7b448e9a5e853af6168499f64e8dfee

SHA512
0bf08ec051a3541072e7c5df166d8adccf53b708a01306330a4a1acf32f92ac485df8cc9dff9f4ba57883ceb3495c587f0014bf903bdc33c85011732f16fd8d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d1ffc34d4f2d2021d668e1c29331c2ba

SHA1
7e161e21d04a7cf8c0958246ddf856b076950c20

SHA256
c65735c28ac400c36eb2f26e6c76c2b9cc252cc0117e25e52712547b8f0b488f

SHA512
4f897f752e70a4f2eef3bca5d28e8ea52d50d1d403ad364f63d14ad6ab4134f5baa3e590ed507758dd0cc6dd1e0cc049333d4e8eb864369b19928bc19b213ded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9549e8fea2d33aacbdd43eb091357102

SHA1
4106871704971930a26eaa6cc4bb9f8b3000abfa

SHA256
8508d9c3c7cae226de9f529c3ad72411c9036cafb975af84d18d7ae2ad51a12e

SHA512
fa8a17fe132aaf7b995b779b564e932bf24ab82f70c713ec78aebc36af84bdd5bb8610eca1a1acfe9af761b1d82ca8a99b17c6594d4c96ff31343c5677a3cffb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d525d90bbdc6fd42cb5a52e8b0cd7f3

SHA1
1ccf0d183b2f5c2030320deb3ce24a61b0df1f25

SHA256
91724fc5c992e9a02b0eef2405b4d4609f2705197f051b9e119e2807cf1bb33b

SHA512
783e871bc8cef4e29ccc0b58d2df0e5d35de5e739ba2f247b7da8a7aa807bb7196b341a80fd32061459fa6c09a0be8adb044578ce3d1c514e84f9aaab532c06b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
318fe5634c1b5b3f560084bc05919051

SHA1
33f2eae1a366c673b698c5c77a69000f3cad9a57

SHA256
5aa9f6831b66b6c1e67022e9798c4a89f0efb01560e6258985cdb4178095df8d

SHA512
fe3137f21a5ff1e814cbd8a40087f5c22b27a71b06d15b15eb66e451f3380243fb4a1d648f3cc2de8a3e8e473fa08904d6213e7403e6a4327f7ed48ebeb67f04

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e943401190bd318d8020286b36b62483

SHA1
ffd8bc00277106970b4cd0faf3467981f708fea7

SHA256
7eaf3ee73eb8fefb63ed2ccfd8e76da53d19b77316ef39bf8b8ea2a5b6dcb0d8

SHA512
1a7d2e63166d71f062bcc325f284516d61f5805312753b4c231054cb04261880bff5d1861623a96a77445930c9d833ebdb9c1ca56fbcccb3b9c4bca5a55f92b0

Download Submit