c85a7d2ee1687e57e8a7b1c7ed6ac8524d6cf488e61d1c7617e14538934a8e91

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22/08/2024, 06:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b6a608edc0ae939840e48577d5c3d99e_JaffaCakes118.html
Size

19KB
MD5

b6a608edc0ae939840e48577d5c3d99e
SHA1

1204330639bb0358ac3c0bbd5bfd654470b4c789
SHA256

c85a7d2ee1687e57e8a7b1c7ed6ac8524d6cf488e61d1c7617e14538934a8e91
SHA512

9f2f9c23eaa583ed92733797b17c3c46b3eca112a8a21da74bd499e7960c6eaec2909fd5667c8ea9357128058163c87ab6e3b6db27b334e42e87cb17b3a368fa
SSDEEP

384:3hchf+ljdHG8IyisD3jzZKCULoONtEXKy2V:xchfwdHVI1sD8CU7tH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
880	msedge.exe
880	msedge.exe
5024	msedge.exe
5024	msedge.exe
4520	identity_helper.exe
4520	identity_helper.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe
4448	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 400	5024	msedge.exe	84
PID 5024 wrote to memory of 400	5024	msedge.exe	84
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 4356	5024	msedge.exe	85
PID 5024 wrote to memory of 880	5024	msedge.exe	86
PID 5024 wrote to memory of 880	5024	msedge.exe	86
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87
PID 5024 wrote to memory of 1120	5024	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b6a608edc0ae939840e48577d5c3d99e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffff79846f8,0x7ffff7984708,0x7ffff7984718
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4172 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5560 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6056 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:5260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:5268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1972,15186283563612188554,11899749969870968052,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
798f49f12ed688ab06148623056573c2

SHA1
2d3f629ec9bf91f6cddc690fb7f2fed40b9acba2

SHA256
1d2c951957f1915412095b474c1662a94a57dbc7164cde5b84e7da932d3df8a8

SHA512
09c740cd5afda72f0116510c574f1eae70a8980fb2a3234433185aca6a1a823dab940a53654ad69ae8f67e3ba07777ad0205ca8472c5fad0fcbdd2589aadf56b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5b65c6e866e26099618a000ee9e7ca74

SHA1
015c2c3bc5282c0beff7d8cfed2577506c2c254b

SHA256
f447e737554fc6827b6e21d702d67eed0d8253248a11c6511750f3f0aad974f5

SHA512
15b81b630a1423891c320749fac96d4c151179bac7573f6ca2f081f82a80254acbe7d3aacdab71a8f6846dbc3dcbbf90af26d01573cbde97775fbe7b80e7ca74

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
e34a858bb065b88296adfabc2c7eb443

SHA1
3d3deb4639d4cbb89c4a45150de0ed59956f972c

SHA256
4dadd254e04523acd617dc81fca2d25f11e1824b573aeb7c5be00a97915884cb

SHA512
5d3ffe004744963b291fcf241a90a9585192547d6345cc2c14c92d2b32fd6b5a58daf38e8650519faf8bd1813bbecc89e710487d6f364da985bb82594a759df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
991b3d6b79af59d679f5a7bf954383a9

SHA1
66afe65cb94d08da2e0d458e0ef8ae4572777c7d

SHA256
7b9690c50bf94d641eac20b359839b113187e89fc2de2a905f40feb77ba5b031

SHA512
63e66f577da330c0565b2f0cf14ed83b315ab248c42399509f32efd53f221f96c4ff893ba7ca23c686e8101c0c5168c1321e11e09fd2dadf8bc753488df4f28a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8a133d7cb9f8582c1e4c58c315cc5834

SHA1
78ad48a159add4fb5b9db279e9991259f883414a

SHA256
68855e8523eafc0a5e6caa4c91add8d30b3f285e732f1acd6b74eaab6b0a6deb

SHA512
4445699ece627a2c47fd07b04caddcb7a10dbed8c39d5c22be2439bff4e1ee04b9334fd99a68c6ec758b406ef733059ae67ecaf23f5b07db83a53c31dfb3e0c6

Download Submit