87dbc17ae07ce174f004f0c7e14ac6b6c2526f5313c4a3c5697be6db444c163d

Analysis

max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
25/06/2024, 21:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f83c9984444ff6aaf80d9f338f95c0f_JaffaCakes118.html
Size

16KB
MD5

0f83c9984444ff6aaf80d9f338f95c0f
SHA1

03c6009900c60ffcbc0ae1cf37f6958f6cfe2bb0
SHA256

87dbc17ae07ce174f004f0c7e14ac6b6c2526f5313c4a3c5697be6db444c163d
SHA512

d511f20cbd27b84ab89e917c2ed42e90fc1b42eb9885b325223a78396cc36fb35a63ebfa36c1e6d5012477b7113f5bc8524662f90416fe661f63f0ec9b648790
SSDEEP

384:C6h6c/AvJ+YeeOlpUFDmFB4sSQIo3VCNAsHJ2:2c/AvchegtjYy1D

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
4828	msedge.exe
4828	msedge.exe
2044	identity_helper.exe
2044	identity_helper.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe
5776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 4952	4828	msedge.exe	84
PID 4828 wrote to memory of 4952	4828	msedge.exe	84
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 2576	4828	msedge.exe	85
PID 4828 wrote to memory of 1908	4828	msedge.exe	86
PID 4828 wrote to memory of 1908	4828	msedge.exe	86
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87
PID 4828 wrote to memory of 1584	4828	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f83c9984444ff6aaf80d9f338f95c0f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa993e46f8,0x7ffa993e4708,0x7ffa993e4718
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2920 /prefetch:8
  2⤵
  PID:1584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4412 /prefetch:1
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5216 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5976 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5996 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3948 /prefetch:1
  2⤵
  PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,2526457659638892788,11374070150206178648,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4824

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4056

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
81e892ca5c5683efdf9135fe0f2adb15

SHA1
39159b30226d98a465ece1da28dc87088b20ecad

SHA256
830f394548cff6eed3608476190a7ee7d65fe651adc638c5b27ce58639a91e17

SHA512
c943f4cfe8615ac159cfac13c10b67e6c0c9093851dd3ac6dda3b82e195d3554e3c37962010a2d0ae5074828d376402624f0dda5499c9997e962e4cfd26444c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56067634f68231081c4bd5bdbfcc202f

SHA1
5582776da6ffc75bb0973840fc3d15598bc09eb1

SHA256
8c08b0cbceb301c8f960aa674c6e7f6dbf40b4a1c2684e6fb0456ec5ff0e56b4

SHA512
c4657393e0b9ec682570d7e251644a858d33e056ccd0f3eebffd0fde25244b3a699b8d9244bcdac00d6f74b49833629b270e099c2b557f729a9066922583f784

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
204KB

MD5
081c4aa5292d279891a28a6520fdc047

SHA1
c3dbb6c15f3555487c7b327f4f62235ddb568b84

SHA256
12cc87773068d1cd7105463287447561740be1cf4caefd563d0664da1f5f995f

SHA512
9a78ec4c2709c9f1b7e12fd9105552b1b5a2b033507de0c876d9a55d31678e6b81cec20e01cf0a9e536b013cdb862816601a79ce0a2bb92cb860d267501c0b69

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
32b17d5623e7fec7b9fb36b5a087c3ea

SHA1
70fb46ea57679825873a6dd78a778bae332832ea

SHA256
071855a77ccafc1b658ae4f5ffb0572358856ecd36182e2c559bb61189ff88d7

SHA512
b9a18104875b5169f3bdfeb4ae8f074a39f5e308401c8b4417ab829c274c5beeeffb8ad182d68f021c256cd287828c17db6d87ef09c0c9e59beba097da25b713

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
23bbec06d122e4ae6e4e6ce8bdcc384d

SHA1
00e087b8a5f3e0b99e5fec01dfd64cb6f736a4de

SHA256
1b7c77549e5207fa08934505668aa5c04f9e3d3f4d9328cd04d67c7a73ea6250

SHA512
0a815164bb1d45cc3a97a06e710e4bce18336cfff00c149075274e840cc94f9ede8dac31ff794c0c15c00a56b042b8acf846d82520b041827510aebd98dde679

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a65cd384c4e28e3f114efe8010dd1905

SHA1
686580fccb92af40be51f0a8912bd12e0e3668be

SHA256
28d15a91d6a4ed9e62ca4c88fa242ec448ffe9b2800a76d4dca870bf940f24c0

SHA512
0ec8e260c3cb914864c3fa5bb6dd01a9f33683b76d8484b21421ee49f543212ca43d5b64a411cbfaa1764c9072da888d423424ec82493d34b9d94f41f6c996c1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f83995f2cf3c8efdbf240774c24728fa

SHA1
0d4667ceaf0bf5901e84c6b39b8614400dde83aa

SHA256
8414cdcf77534ec218c5cadab996f927953f58103b089fe3cd0d22b5a606ce25

SHA512
2d01247b4d3e8ffd3dc20d5c856ba018c3d4d944272347b2ca55f880122f59726fafe34a4a329eae4de6820a47ba3c86fecbb9b759ab4e98049ab957144193e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
712587381b1e8e817df54b462c13e52d

SHA1
8a3b04de6ca631e359a4e996190fcdc43540e8c0

SHA256
04656c42e65389cdde3cfb5227f7b55dc0a7e22026f4fa51a39517c96ef00430

SHA512
da1c1ac417de8c4aca2efb927d6f159b3ed0aada20d70ad3064c8ae5c23b2379bbf37d36529770469e6a32a272d39d317248a01e80b985bf9d126e511ca644ef

Download Submit