f52edc080c6de22f3c98909277f0fd4d614f86d7d272efacb391085bbfae9ccb

Analysis

max time kernel
145s
max time network
127s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
15-04-2024 04:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f0501dde0cf0deb4defb2eba8e2e4d7d_JaffaCakes118.html
Size

891B
MD5

f0501dde0cf0deb4defb2eba8e2e4d7d
SHA1

0373eb62e9efef3a6b6d850e25cdf263eb635692
SHA256

f52edc080c6de22f3c98909277f0fd4d614f86d7d272efacb391085bbfae9ccb
SHA512

4e58bba47972505cd54b98efb6f14b13d084fc8df6bd1fbb5a17ff2c30930a5bbd733911ebe1baae5ecd2798c7ede914c3ecf8f67516a0dffc34ef232671c9e8

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3264	msedge.exe
3264	msedge.exe
2992	msedge.exe
2992	msedge.exe
2332	identity_helper.exe
2332	identity_helper.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 4240	2992	msedge.exe	86
PID 2992 wrote to memory of 4240	2992	msedge.exe	86
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 1448	2992	msedge.exe	87
PID 2992 wrote to memory of 3264	2992	msedge.exe	88
PID 2992 wrote to memory of 3264	2992	msedge.exe	88
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89
PID 2992 wrote to memory of 2740	2992	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f0501dde0cf0deb4defb2eba8e2e4d7d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe1ddb46f8,0x7ffe1ddb4708,0x7ffe1ddb4718
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4268 /prefetch:1
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5408 /prefetch:1
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1476,7361584290654140407,3867444226565098193,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2716 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
7b56675b54840d86d49bde5a1ff8af6a

SHA1
fe70a1b85f88d60f3ba9fc7bb5f81fc41e150811

SHA256
86af7213f410df65d0937f4331f783160f30eaeb088e28a9eef461713b9a3929

SHA512
11fc61b83365391efee8084de5c2af7e064f0182b943a0db08d95a0f450d3877bde5b5e6a6b9f008e58b709bb1a34f7b50085c41927f091df1eea78f039402e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
48cff1baabb24706967de3b0d6869906

SHA1
b0cd54f587cd4c88e60556347930cb76991e6734

SHA256
f6b5fbc610a71b3914753feb2bd4475a7c77d0d785cc36255bf93b3fe3ccb775

SHA512
fd0c848f3f9de81aca81af999262f96ea4c1cd1d1f32d304f56c7382f3b1bb604e5fbe9f209ad6e4b38988d92357ef82e9668806d0727f2856c7dc1f07aae2b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
360B

MD5
6e1943f5a783b2412c667b828592af5c

SHA1
983becf61c44577a68cbc6f75993f411a46884d7

SHA256
934af73b3ef7ca400e625fbd37cdbe89439c25a5fd7349c206a82b99f3d61969

SHA512
e397286603cce28ee158163246d9a788ba47c4fe340e5825f9b4b0fd7154f77663f6235bbe5e8adf18a4e1a576260186b4e29b4223c6a7f82e801fbc74351175

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
831ad3d05da31e255b8bf95ec60fc642

SHA1
7ae8dc82863cbc6d35e889aafd9d38b9e6767471

SHA256
6f23ff27e5d28031cf686ff443ab64a8d900eab4a898dd4f5115007fd9b3849e

SHA512
c5f4f8bd5674cfd004e6140633840e338aba9c3ad0fc2be7d0d0c2c317752877213a4fd7eb423d8107a8130ac05ed753453228c8e6e8ca98154083c114fac528

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6e18def4bc8d45166cee49c39656d7bd

SHA1
3350d75ab161a0d4553ff893407f19bd5b3916d3

SHA256
b72d17e4840a04066b0adae6e78a2d53cceebef7ed5b24ffe342c6ef0cf1313c

SHA512
fc4e8c8d58e2b6e3526a1233a429c9f6b75dd6d920b9db8d5355d58732bc34121eb89015ee209476e26a0a3089f5eee648a84d13f2ce26c0fcd9d766be7c55ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index

Filesize
72B

MD5
0c8c666523eeb2999254c470c8b79bbb

SHA1
e2052ee84d3bee6a64edc7d011441faee5b056d4

SHA256
61329b3beacb66cd8aed3322481deb8b30b8ecafa65dd991411a27eeeaf4b456

SHA512
525b460c1579f1599b7becb4e2f9796cc7e6b83c56246fcf9866e4f6d368a25ed0f78eb9f5f90b5347ceaead9d4f5945213445c2eab7b8945ffb42948470d926

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe578d5b.TMP

Filesize
48B

MD5
be4e889bf2d2880d622587a790b7b699

SHA1
7e857f98d3cf9064760a205eb3e4bb1a6a866a64

SHA256
6dc9ca9d48a745a54e981bbd19e2af0b823ccde5472d8d45b7fc654c304292e6

SHA512
652921566130462e27c33de41aa5ca2f654f901428ecb1d15f6472636c5b3f49ee9f02f2ba3def98ff9c595e6a19896e69b48fb109fe5553d4f00b46eb7874b5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
9839c9528419793c60e3ceb57d91590a

SHA1
96f669957f5355151af1b1f83cc39e7e0997c261

SHA256
eaa760f6139f5edddb0e6b1c6301162ebf85136bb2db0255f966674e10afff66

SHA512
1dee059fc57c4a62a44842d46527e23aa11c66d6c0cdc204e7a867bf71cf8b596ab6b9ca3b79d625b0b99cd2a7773d46e2d2cce5df8e92c956a545946e4e0c21

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
5e3270ad8231938dc6bc6c093091b730

SHA1
c3dc87b17d4e2228f4ee894e91e91c0ac4afc342

SHA256
4c28218685515f6511acaafef2cecb8aa4459ed32f6baffbff7f5a8514ff5a89

SHA512
5dba6108189a70d8fbcc7c991c60424a9b52e584d060ee07c5c5e7779bb703b8e8e7617f3f52ed2b4d3c4cfe296106c18ee324fb04f71c5e6ac3098214c144ac

Download Submit