b023ddcc265166019ea504f28ea6113059ad4960a289520ec8bfe775693a56d4

Analysis

max time kernel
147s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 15:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

849f68a3b3dbef0d2962feac7c6283f9_JaffaCakes118.html
Size

215KB
MD5

849f68a3b3dbef0d2962feac7c6283f9
SHA1

1c21659539f8fe5a1cc9d9c626c3d51917afeaad
SHA256

b023ddcc265166019ea504f28ea6113059ad4960a289520ec8bfe775693a56d4
SHA512

3b4288bafce174da39fd706ce0cf51993a983ed8e5cd46b8abc7608b3a203462c902f75511156a4ec5f29d54cb9152ae1d6498c194bf0b6d42704e097938d013
SSDEEP

3072:sY1i3FEPBgRI+thKGPv8AtyeEhqqjvHgzJ3G2CBUZk+NntgUWsJF2:q1FVkAt0hpsi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe
1864	msedge.exe
1864	msedge.exe
4304	identity_helper.exe
4304	identity_helper.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe
3244	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe
1864	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 3772	1864	msedge.exe	81
PID 1864 wrote to memory of 3772	1864	msedge.exe	81
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 720	1864	msedge.exe	82
PID 1864 wrote to memory of 5048	1864	msedge.exe	83
PID 1864 wrote to memory of 5048	1864	msedge.exe	83
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84
PID 1864 wrote to memory of 4028	1864	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\849f68a3b3dbef0d2962feac7c6283f9_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd3fa246f8,0x7ffd3fa24708,0x7ffd3fa24718
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4944 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3432 /prefetch:1
  2⤵
  PID:2888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,4573221279645106260,3888869493392715135,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4840 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3244

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4236

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
49cfb84ac0869633a7de833fe6bfea80

SHA1
3176b47ab3bd6bfd6cd60b5408c08d0c85fdfd07

SHA256
e4fe8cce08d531ad37e791770aa759dc8f895ec97f4215ce904ed7e3450d1cfc

SHA512
76a5d0ab9a6e1078e12ff14a7ada0d2d936902962785eaced74e69ebd9aec1a025cb27510bf3290037f81c28b30b7efa5154f40769516ba654aabc06b2160719

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
09d6adc76d96929a1ee731e78d46fd85

SHA1
02b85ea9cdbee86273b205f91a4106946f161db4

SHA256
2adb02f9ff3a87538bb790b8dcccda82573475d75915ea923ffa8e447b4afb4c

SHA512
54f15668b98878aa893725eb769be3fef20fe9cec3a112465f6ef72ecc270d765a2fa7118f8b50413cbf3781978ab4379311212928e045d45c3ebbc83f68885c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8838306b8e57e3df6092ce750f0202ff

SHA1
b1a4f86963bb9c6c106a6e3b1860bc6a06ffde41

SHA256
af52ba69d5c85c6b6b411efe324c8f3e53c1cd170e886f150d3cd6abe515fb81

SHA512
d5e14372765e85ce907a29185598e423cc29cd226f69ab66c2139f4f25f7d232244f8b5e9956dad824c54d29564f164a4011092388d255759be3b2acb80e75d0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
56b8f2cfc45526c6e298f38dafab3ca4

SHA1
197b9c6a119d170943b2c5bde5eb9fbd6ec6f554

SHA256
73b9d60b66b37c74f873c90582496fa206dcfd16b58f8a39cd0a3e1ce3ebfbe7

SHA512
4263d68265906d726b5d7ccf128594ccd6bad62489abe4bb4d147b1b0b82a72ac7ffbe2ad36e0aa8769716d4cfa165557a1c57f9dc47dd83cd637bf31f7ff3d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a604438c-4441-4655-8cee-cd1d67873a21.tmp

Filesize
2KB

MD5
e8c07bc528be46adb9cd684ca61dfd42

SHA1
676207fe505d4b5e619dcd4e3d9bf4f0fd0a08ec

SHA256
1f06c86fb34d7b240bb3b458de0c20139fedf6856fd72b60b73f4c4e407505d1

SHA512
b34357dffbfe3a5c16da6153bda7fc6f59799e0e773341e5d0a4db09547b09e12816e81f61baf4062d005f187d903d863ad95a2daef4955b1419b19795a840b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dbd348e04fa1f0c8d290c58b71a45d77

SHA1
66e23bdfdfe14abbd118ca915202931eccd67e3f

SHA256
bd583eab6e86936ab52c34f2da6b4f9c553a36938a94a2b2f0f2c7e6806dae97

SHA512
57de96a22c2b61fe445411d60da8b1ed092734f476aa77c3110359a4586ab12bf66cc818b6f261d1a72a130bbec0f069f8b2a9439fe02603675987b3d35c4f45

Download Submit