e2a33197b4c66a1840b1ab55f25d285ef8fcd64588ec3bccc0304ec25971f370

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03/06/2024, 07:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
910056764bbd7f73a435bfcfc2b23e48_JaffaCakes118.html
Size 49KB
Sample240603-jmsf3ahf64
SHA256 e2a33197b4c66a1840b1ab55f25d285ef8fcd64588ec3bccc0304ec25971f370
MD5 910056764bbd7f73a435bfcfc2b23e48
SHA1 d8824ef4a77c32728d25c581b7a5f589c902abea
SHA512 64af642d228429f08da32081759a63fe913d902d6d4840fc7df992bc10878414bfef5ab2bf9e36f7d6b442d2d76e38e228c37ccb0b0c219eb853c2c7ad728ebc
SSDEEP 1536:YxKqUU0EeyGKgQiXZj5DN4srDZaMkvww26rGrV:YxK+0+2XZDD02Eg
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4168	msedge.exe
4168	msedge.exe
4368	msedge.exe
4368	msedge.exe
756	identity_helper.exe
756	identity_helper.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe
3568	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe
4368	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4368 wrote to memory of 2236	4368	msedge.exe	83
PID 4368 wrote to memory of 2236	4368	msedge.exe	83
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4108	4368	msedge.exe	84
PID 4368 wrote to memory of 4168	4368	msedge.exe	85
PID 4368 wrote to memory of 4168	4368	msedge.exe	85
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86
PID 4368 wrote to memory of 956	4368	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\910056764bbd7f73a435bfcfc2b23e48_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff850fe46f8,0x7ff850fe4708,0x7ff850fe4718
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2752 /prefetch:8
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5056 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3992 /prefetch:1
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:4736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,835311920035192789,577375685242238709,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5648 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3568

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1304

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2584

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa
MD5 ce4c898f8fc7601e2fbc252fdadb5115
SHA1 01bf06badc5da353e539c7c07527d30dccc55a91
SHA512 80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1
MD5 4158365912175436289496136e7912c2
SHA1 813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59
SHA512 74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 588B
SHA256 34c56b1113cd4f2e15d7eefc7ba64f9b66b3da90813a0a9059ffacc023e237df
MD5 e402ad90789839b2554146047a84d3a6
SHA1 c129cfd9a9d49065f9c72fc6f660af083d8977d5
SHA512 463c32f7cd3ac1c2e6a54e5dfb9dba04514c7ce253baf484aa0ba22f9cabb3bd049356f03ddbf157aaa8888a3639a11686614f8decb71a8f8f621f28a35e0210
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 dc6b2ff766b6345e2ac51f706f4b865c96a55cad457a85b515710eac61532492
MD5 c44b0d52fee4435a74f7829c4921f187
SHA1 49c358715a2d09f51e82dcb7e368624619ae101c
SHA512 e4aab1de2ef23cb97253dcf50e5310efe37290f4128f3f67ef48293fe9fece8cde5c6aa971b2f31809b91a069c87b652ae13d7f398c1ab5a4c43b0f91304a397
SSDEEP 96:ndkWr1eySjuwpvWMoiVmdeEP2vSSbbdUWQyV+VDCAiEwb:ndkwAySjuGWM0P2ZBrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 a4af08723b984f75b4eadd33e8d73702e6281959291a6bafab89f354857b0b9c
MD5 6f92f28e2219821f879f5b33615f9d9d
SHA1 2a3dc7dc9f95f7663cfe10bea1f85199be1b8529
SHA512 0b45f68774121c49bb844c88ebb7a813510be150540f23e249306021bd7d6f35fe09aeb93d2291179843456673a27702c8fc6f71711cb0e95b57cdf6843f6c12
SSDEEP 96:ndkfr1eygjuwpvWMoiVmdeHvSSbbdUWQyV+VDCziEwb:ndkjAygjuGWMXZBro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 58713d6054c5d4ff957389cdba35f7f150b1e83982e20ba53449382fb409e8d0
MD5 c512cf51d9e5e9e1265d7ff11fbf1790
SHA1 bfc5ee51b847e738a3553d372d3bb2efa0e47c5e
SHA512 5b778675f10ddfbfbab0fe93a196899916763f89c83ba437052d0a8d5f76f0450e57eac8b5f93ceeb551006f45f3f4ee75c15dfefeb1ebb7043a12fbc7a0d6a6
SSDEEP 96:ndkWr1eygjuwpvWMoiVmdeHvSSbbdUWQyV+VDCAiEwb:ndkwAygjuGWMXZBrV
MD5 SHA1 SHA512 SSDEEP

Submit Download

TransportSecurity

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity
Size 706B
SHA256 0aeb1816c6a9cd64ca90bbfd3edc1e83767c0e347ba022e51574a9f39fde25f4
MD5 4ad7dd88c23cfbaa285b4a2e93aa129c
SHA1 6cf939d5bc229d9450672e74c402f887f33e85c1
SHA512 6ba5fa96e301c6bc384b4880f4c6e1c861dc6074fe108ffbd4405484ef638559f00a9a619d03d5df0865b8d32e621b10396319a738b503e3c8b2da85f6119652
MD5 SHA1 SHA512

Submit Download

TransportSecurity~RFe580162.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe580162.TMP
Size 706B
SHA256 4b57f2a18680354b1ea543f14b331f4fbe4b379da855fd8752d055d8a561fd46
MD5 d2afbfd269d45285aa74e8d89f437917
SHA1 1179f21406c9210fa9094c6226302397e3804b48
SHA512 49a13055df6061c1a532195e8be5af64921f71957ed198d002e8e3c5dd9b7a134589373cfb519794848bbda894e572122f8b138f66b3cd29e2ad6d97763cccf5
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 88aa73cdc34db1ad9ba9f61e7e7157cc8dee61dc53b24b0ff736120b221f0aa3
MD5 bdb91a2cbf009ce3891eb55386948ab9
SHA1 8f4b1415c06d76e39dce4bcf67b918e7e2fa8fe9
SHA512 8da1e4fbd64273ce2298a1e43c07d705d8594d7518fdd120127da521f5dd3d8b9881f7200c5c1a0e4c3d8c1bba9636afe80370445008fa650b4035bea5073882
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexup90qe2RUVRuf3z2OMDCRHqk:A9iIxuERzA83h09RZxY2kPfaOMWRHqlO
MD5 SHA1 SHA512 SSDEEP

Submit Download