b05f953ef8320876e759cd88a0be19e07cfa9af448030c858fa87b2da55a156c

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
22-08-2024 12:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

b7b1f41c909fefb4689e864937bb5c20_JaffaCakes118.html
Size

19KB
MD5

b7b1f41c909fefb4689e864937bb5c20
SHA1

7e69d16c3639096185d1a19d96d6b4d1a6af099e
SHA256

b05f953ef8320876e759cd88a0be19e07cfa9af448030c858fa87b2da55a156c
SHA512

e0adabf25637b97b79591f354186b98b9daf37a7a1e7fd81cd56f85d14c2a889fdcbff30299d50d9487aa94b7ee3479536f71cd7cc5b8d2a960506be999d5f81
SSDEEP

384:L5TPUcTIkkwRlmCkJWOqk3WQXfEy5hE8Eu5ebDB/GRmNqJ2:dscT9kwldkMefHXAHBOUN/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3664	msedge.exe
3664	msedge.exe
3084	identity_helper.exe
3084	identity_helper.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe
876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe
3664	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 2724	3664	msedge.exe	84
PID 3664 wrote to memory of 2724	3664	msedge.exe	84
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 4752	3664	msedge.exe	85
PID 3664 wrote to memory of 3512	3664	msedge.exe	86
PID 3664 wrote to memory of 3512	3664	msedge.exe	86
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87
PID 3664 wrote to memory of 4280	3664	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\b7b1f41c909fefb4689e864937bb5c20_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe318f46f8,0x7ffe318f4708,0x7ffe318f4718
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5704 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5856 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6048 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,1035443577263287090,14154512489461212380,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1976 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:876

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2948

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1b7813a5-e37d-456b-83c2-435d460faf9a.tmp

Filesize
5KB

MD5
034574ef785ba3f25a5330bcf901b821

SHA1
fbbd0647ebfcd8a2f827b8956e2b5d688806617d

SHA256
a160328f5ea60179db30f2eb0f3763706a5af38e1faae9713deae52fd8424c42

SHA512
e96c6c5094e7061f0e0963286369fdaf170b40a8d60922a28f1d700ac062fa2f62c0952c2df1fc288b8ec9f8e3e2964a960836f6f737381e2b4a2272f44e6b1e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
212KB

MD5
2257803a7e34c3abd90ec6d41fd76a5a

SHA1
f7a32e6635d8513f74bd225f55d867ea56ae4803

SHA256
af23860fb3a448f2cc6107680078402555a345eb45bc5efb750f541fe5d7c174

SHA512
e9f4dc90d0829885f08879e868aa62041150b500f62682fc108da258eee26ad9509dcbf6e8a55f2d0bdba7aa9118dd149a70a7d851820d4ea683db7808c48540

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
773e822ac01e8b58285ecf43cf8248dd

SHA1
8981a0c7ba446d612225a92b385fcef43a1e1785

SHA256
a9dafb619400fe444efa2a9832fe05bf84f569ae4a46b13278c7c7bb46d02a4c

SHA512
152a111179855a76d07aad5ca25e32841cf5fc684cca6552089d1a3f6f3daf37fab22e70505446777a16bfa9c61cf4af8413fb77b5b50a7b5d405397cfab8453

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
ada657137eca592b71bc7e4cf47b9789

SHA1
4771230ba88142ee92c7ed682609fa96a7e1f472

SHA256
92d2a3b2fdcd3c7fb631c187dd0a1b5f3264b0d5699cb3768ddb915e802d32be

SHA512
01f3e45439ac87fa3cc3831a9df2f351f38178a4037ca5217a98247db77aa8f74bca1db761085faee4a5a7e94c450b6e33c724d4f3633728dcf68f7d32b3fcc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5c0607f1b98686dbb8ac22f5491fc6dd

SHA1
32d465829f460f22915d4947323fe75da71aa101

SHA256
9c460479bb6b65bac1306381455f9086ea47cf4ae3edfb5eaee041c6b4b0328f

SHA512
68bc67c8a9e13e11a85d59e7c0a57ba346bc97ab256263b4bf7de7ca832731367a2a54890a998990ba5f4643e2e7fa7bbbb841858a3bb670720a7e78d307d70a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
ea772dd20bcd1851ebe68f8f862759da

SHA1
bcb90dde6abc3c763ace66260cd331b81b2684b0

SHA256
ce03ec0254a4cb97869d8ee2989aa51e865dc0e83ee03e31c9c0e89461c16ef7

SHA512
05c66075c42ee8dadc3c47be33f92049d435dc42da3253efcc9ae072cd4088429dc56fc8a0417c659ea734567061286c774fdb4cd38ec2be0af7b5ec37b950fe

Download Submit