f8400261837604ecf7823b81eefabf6ff58c1d5a1d344aaccc0505db8f40fe1c

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
16-10-2024 02:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

4b0ac9cc4e0ecce0975059f7a137071e_JaffaCakes118.html
Size

53KB
MD5

4b0ac9cc4e0ecce0975059f7a137071e
SHA1

80839f5793514f8d3f30982bed2944b80fa4f66c
SHA256

f8400261837604ecf7823b81eefabf6ff58c1d5a1d344aaccc0505db8f40fe1c
SHA512

4942a7d62040559beba5e0619a0633370003503ef24491e4263ee83ad84f1d1af0fef5f5c791ec98fd51267a7c05a6c08fd625d8654f13cd3027b538d4bd4af3
SSDEEP

1536:h33HdU8v9TVBhc+Y7UHTQyI5Qxl9UeFhhzpcgv9oDfPoFd:hnHdU8v9TjhcH7S7I5Q1UeFhhzpcgv9p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe
4808	msedge.exe
4808	msedge.exe
396	identity_helper.exe
396	identity_helper.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe
4700	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe
4808	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 908	4808	msedge.exe	84
PID 4808 wrote to memory of 908	4808	msedge.exe	84
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1788	4808	msedge.exe	85
PID 4808 wrote to memory of 1232	4808	msedge.exe	86
PID 4808 wrote to memory of 1232	4808	msedge.exe	86
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87
PID 4808 wrote to memory of 400	4808	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\4b0ac9cc4e0ecce0975059f7a137071e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff240946f8,0x7fff24094708,0x7fff24094718
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2040 /prefetch:2
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5548 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4816 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6860 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:5272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,8211841108139444637,2477855929941533993,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3504

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
9408721e16dc70fb726ba059acded021

SHA1
2ea408247c4d9c56ece31034b75a66a7fcacc6f0

SHA256
a94a8964c4c96063b23a7d6bf38863ccb0004710b4939ca699ac0e035fcc7cc0

SHA512
08d39fd7c34c37260f2f09c036c35ffb7f782526087c53023fcf18057030310c0dea30fec361c50014a152da587c98aa5e05c03dfabbb9ae6327cad77af60852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6e1596e0e4a6bf2e07f1ab0c3672e10a

SHA1
a5eb47aae647318da58a583eb66353e36d7dd6e2

SHA256
5c1e11054989d3c3d5fbaca4fd589f8ac776cd7fa400458f09cc6802d888b529

SHA512
03485724bfcfb1d2aad167d2af8f872d716db4093643df776ec903997a112b6b741db0f5faa179ad596c3b56dc520d970e027708abb965dde135ed55e682a89f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
194e7713161235bbca703032e1cca65c

SHA1
1524f9b678da8e025e328db1ed47b63421ef2987

SHA256
09736208da9dfe67c1e3fa031274dfa55af0ab71160efcf38d5c2d517eb3d388

SHA512
00fd0635ced11428a3fbaf431f6378dfee86e16527242e3296a11c41988accabe72dfc3f6634e7b136933aa969d5cfe3e0a910cb218d35de4be4a1742d804eed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
3e3ed58419899ed5147fc3deaac3b9f8

SHA1
1296057c706020afa619d5590c2f359de46c1728

SHA256
fbde733ed16df6714c7faa54077c86a69b29380b3d8db4b0f93b697cdd45476a

SHA512
283d140d577d08cf3176460941176ac9c9a358ea84742f953706d268556ded15976957f47d851b5cffb5b2a480435f5dd250529fd2573beb8827700cc1f73974

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d38fd265-3f28-4c3d-b46e-6ea3819dc989.tmp

Filesize
6KB

MD5
881f91a0901851e574c3b9f35f8fb4bd

SHA1
50b571df34a54280c50879af935963f028b99892

SHA256
e3fd0c71057152ba9c3303a3d2d4850dedb1b817c082189b19691d3b1e60ec91

SHA512
9756c475a3bb75954bc4551a5561180f267872d628d3ded956fec84f6bc42a64bf3e0d33d962fd9632ba5a2f905bcbc8efc182279c078d98800402e045ade8bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
a3cee77953c40994574a7a28e01734ad

SHA1
44ccb5c98699477cd231659bb4424169d4c353ae

SHA256
1cd2a5590152e70469960feeacef56be49f53846a63beae818df3fceec1a56ca

SHA512
9134174e7a35c361b4fb3df383e38e1e041a8a3f2f18b4c3f37b120d45b6d4fb8d5959d5db722d68b149a3957b907bae1f08d51f60ee67c080715b7bc8c44bb0

Download Submit