81db1f8e02dd5882697e4ee003a9bc02e8eee243aa3601e7265ebd334067ec2b

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
15/05/2024, 23:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

48746394befdf67a7c7f463bb5692f49_JaffaCakes118.html
Size

18KB
MD5

48746394befdf67a7c7f463bb5692f49
SHA1

4be74afda174f888a24481dc1ff8573d41f1a334
SHA256

81db1f8e02dd5882697e4ee003a9bc02e8eee243aa3601e7265ebd334067ec2b
SHA512

8497fcf166410c89792273ab4131979437bb5915dd2dad7827c514904c0775e2a3684f71b19f2f14473ecdaaa0439a220d743c769e10df963b53cbdc5d036f41
SSDEEP

192:SeVAnaaNN5OKFqM5QsG7LK32D8B/eSMF+ojdiFLlHR8YL:SEEaeyKFqM5Qso0RBGpjdi9leYL

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3916	msedge.exe
3916	msedge.exe
1220	msedge.exe
1220	msedge.exe
436	identity_helper.exe
436	identity_helper.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe
1220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1220 wrote to memory of 3680	1220	msedge.exe	81
PID 1220 wrote to memory of 3680	1220	msedge.exe	81
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 4820	1220	msedge.exe	82
PID 1220 wrote to memory of 3916	1220	msedge.exe	83
PID 1220 wrote to memory of 3916	1220	msedge.exe	83
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84
PID 1220 wrote to memory of 4388	1220	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\48746394befdf67a7c7f463bb5692f49_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xd8,0x100,0x104,0xe4,0x108,0x7ffa632546f8,0x7ffa63254708,0x7ffa63254718
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2216 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2148 /prefetch:1
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5456 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5828 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1292 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2144,5912478506887337833,4891144695898756068,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4880 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3008

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:656

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
977b27163217e2ef27535063f3818526

SHA1
8d266f4d3226012f0100982729ff7d98dbcef855

SHA256
8c40b85f79552e2bdd7e168188bba0205f2e3ec156516e22307b8010909c999d

SHA512
cdc38ab5e173d3a9122f5f0846713eb61354bb81ee26ff41b65342c165bdbac6b53f43bcaeb365dd21d5ed8105c8ea6183e4c737152d302a0de9a2a972c9e33c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
db849e05af116bf9655d06a066114615

SHA1
3410f30f6da3fcc48e0ac1d9107a887ec9603a8b

SHA256
2144f0ef7966acebf26372e79874eb9e540596398a75aa53c59ca23d67191e17

SHA512
13cbcd16724fcee75108258c397bf93067d61fee8fdffad46d31f605a7fbdb2dfa95fe8b540d42079649b1f3796fb53b1a35d1b3134e5f08351604bd963634b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8b9f3e8c36497eb44e40cbb6b4d5be8f

SHA1
0580b3e950cb718915200f936b1f9aafd8d33e5a

SHA256
d828ee632625bdc125d2bca8866a9bdebdd1560a2bb83705dc0aebc7f7d784df

SHA512
239b4f2b1f47b659af01960b60ac3ec55e62c1e2e4fcbee8bee84c19045f427d9fe0e7af30c7b48f56867946d1799869e25ea576bb9ae8d29a464771fe127bfe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
76ddaaf073ba8547668edcd32a645e3f

SHA1
fc2a805cedbd8be19ddfac25252168fa0f3e83e4

SHA256
427d70a5acaa30ab05df85c5ca84113499183a146ce0e34313cac9b423c72725

SHA512
1e5f5be7d1f7ed97e8771657e2bb01c0eb9bc3745c45fa14f3e47fc8052826f502ee39cff13b55e8de46021ebc619ac6fc179f3b81ab496dd1f232d6124813e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
25fe92bebcbee3d8814aae4c4c9c4723

SHA1
45fd716a975e14c907aab304f041185512c7f9cf

SHA256
46e51721b478dbf54a9f666c296ceaac2e3e612e1ea2f3ed6d23916e2cb1a985

SHA512
195f4a90012dc24a415b5fd4b4f26a21594b435b74f88abdd24892c24fef5526c04f1f10d1c5cc52db11e32654521a8cd1df626a54aca3899513e5c24c067eab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5cfff6229ee0f7a5c71206fc2dbf7587

SHA1
b8d683b1973fad87b52ac5aef9df28725f680478

SHA256
2b5b47eb31c6ce80809bd3802d2b8659148f3a9c49d30b13ac013e80578c341e

SHA512
bf5b0f17980af6a8ef9795b08d0d4649da81e46837fc5d5f2c3b197c76a279d13c3d8162370c74d19a9cbfb49dadca27f63df31a420ac8cc710921c44e4f3121

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
e26b84885d478de7f9d5e2bee7cadb0d

SHA1
409c2602e115f9b8a8977649461efa5dec952953

SHA256
f46114ceb6c15838176f65d28000e70c27b6467ae21c1dabd538a57b8e450c56

SHA512
528a832011f3d033cc550e03180c9b44b71341cbc5c2bf0e7087ce8eb8bc0285d51fc20e778700e4d632d673dcaedce53f798ec88d78467318a60dbcfb512b30

Download Submit