41076f0032f0891aaae1e235735d1fa286615016ca39f6da8ff745e5d24977b4

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19/07/2024, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5e0651b4e98241bb1260c09292b0968a_JaffaCakes118.html
Size

14KB
MD5

5e0651b4e98241bb1260c09292b0968a
SHA1

e6587247c5107dfcc7d1a5e013219fb1698b41fc
SHA256

41076f0032f0891aaae1e235735d1fa286615016ca39f6da8ff745e5d24977b4
SHA512

da57ae11f4da0bcf94a4936dc475f81ce7a3559769e9826c83661423b3d25ca8566baec8f614f278036036acdd6c19f7da9b5fea7715390262f8e0a2d78cc009
SSDEEP

384:obycElvzgYRfw25xMJfDJEacUkMXSThJ2:bcElXBxM9EvMXST6

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1932	msedge.exe
1932	msedge.exe
2880	msedge.exe
2880	msedge.exe
3676	identity_helper.exe
3676	identity_helper.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe
2280	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe
2880	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 3920	2880	msedge.exe	86
PID 2880 wrote to memory of 3920	2880	msedge.exe	86
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 4196	2880	msedge.exe	87
PID 2880 wrote to memory of 1932	2880	msedge.exe	88
PID 2880 wrote to memory of 1932	2880	msedge.exe	88
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89
PID 2880 wrote to memory of 336	2880	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5e0651b4e98241bb1260c09292b0968a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcd0d146f8,0x7ffcd0d14708,0x7ffcd0d14718
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2416 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2812 /prefetch:8
  2⤵
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4340 /prefetch:1
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6080 /prefetch:1
  2⤵
  PID:644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6096 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6432 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,6435040249560909442,4761345014245893981,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3068 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2280

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3968

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1f9d180c0bcf71b48e7bc8302f85c28f

SHA1
ade94a8e51c446383dc0a45edf5aad5fa20edf3c

SHA256
a17d56c41d524453a78e3f06e0d0b0081e79d090a4b75d0b693ddbc39f6f7fdc

SHA512
282863df0e51288049587886ed37ad1cf5b6bfeed86454ea3b9f2bb7f0a1c591f3540c62712ebfcd6f1095e1977446dd5b13b904bb52b6d5c910a1efc208c785

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
60ead4145eb78b972baf6c6270ae6d72

SHA1
e71f4507bea5b518d9ee9fb2d523c5a11adea842

SHA256
b9e99e7387a915275e8fe4ac0b0c0cd330b4632814d5c9c446beb2755f1309a7

SHA512
8cdbafd2783048f5f54f22e13f6ef890936d5b986b0bb3fa86d2420a5bfecf7bedc56f46e6d5f126eae79f492315843c134c441084b912296e269f384a73ccde

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
211KB

MD5
151fb811968eaf8efb840908b89dc9d4

SHA1
7ec811009fd9b0e6d92d12d78b002275f2f1bee1

SHA256
043fd8558e4a5a60aaccd2f0377f77a544e3e375242e9d7200dc6e51f94103ed

SHA512
83aface0ab01da52fd077f747c9d5916e3c06b0ea5c551d7d316707ec3e8f3f986ce1c82e6f2136e48c6511a83cb0ac67ff6dc8f0e440ac72fc6854086a87674

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
31d15c6c540cdf204175ace148dbf8fb

SHA1
e7d6d6984163914f2626a4fe96a47cc75f399a6a

SHA256
76654668584be7124c7a082373c074d993532e3c991b303315dc0608da435d2f

SHA512
297e733c7150be5b645f93c5af79576e499b9c0184ed9ba8393cf0b31438ce4cba5cfb14dd009e2320370ea55a492e8f9ff9f209e81b82de4069e9d27ca19ad3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
96c62c477be2f40c63790463875b2454

SHA1
544c21fb47b282aa5dc98257e8d7e999b1ca7bd4

SHA256
622f819d07542bb35dc535c7c97cb318ee08b457fa6c4be3818631aca20b9f40

SHA512
0cd2b6dbdd986feb4d796b818a3a3d243e7528dc8c1d52ef516cfefaafc7be2bc36bdf49e9e3c35ab0a25a0891294627d46e9d34c1d177e447c6b77a985e424f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
73d028f7ff0d72242aaf4d8c3ac12bc9

SHA1
ece539a1e473eec736b705b9ffec253e2f1cf927

SHA256
e30ca28d24e9e92a400c895db04b5321530685fa391a9e2465555771ef46e235

SHA512
09182f07516cf57859f6aa12f4d6b476636cb4cb7b325a0d8a010f0659ada0e8dd98d591fb9512e0f2fdaba447ae7327b0e420ec7c852c1673baa44e365d14b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2e6d16e2065e00f8c195a3d553fc4edd

SHA1
01332fcf80bec60bf51102254f04d66b88d8d4d7

SHA256
a96afc7b9ccc869f4723841250374f3c520393f2b26450a7c19c3346313401a8

SHA512
496378897387ce8482cf85e0d3722e558fc82ede30cba0589aae8510fad27aceb6dce0eefee23909b841c6f7e066f1ec67e70d40b6b3a91f1093df62ed09d7e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
a6d5ea0e02f8bbdd8f904d7b2f0a911b

SHA1
053b4f9db5a1a09c495fe261e6f5a15084c74c08

SHA256
7ada3cf34d23f8f21327f507e08be743f6c19a4dc72197f14eb43baefc4688e0

SHA512
b04bfd6b191438d57ec0b65a4aeb4763ae60852340f1d8cc6793e81214f4e96fbc89326fc84e57062bedeb15ef1034eeba96d92c7843f37269cf421f4d4e6e86

Download Submit