c80a8f9fe76cbf4f934ef53e19291b17cf2a04b12fbaaa1d82e3d6dfd8073e1a

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10-08-2024 06:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

850be4a4763e365e983c6d3eb53a5e98_JaffaCakes118.html
Size

92KB
MD5

850be4a4763e365e983c6d3eb53a5e98
SHA1

08970597ebb8b54964810f6165bfd7d5bcd3c6b5
SHA256

c80a8f9fe76cbf4f934ef53e19291b17cf2a04b12fbaaa1d82e3d6dfd8073e1a
SHA512

b206d5be7a599b73b459d39389687a89e151fe11773ab74feec7031f0c23595707542bdf422195b90fda1855ed31586f6653450a5ca9240d1a41367aaddbb731
SSDEEP

1536:f2OrV46BuBZFuNGZ4OeWIlLPccaw6E6ukJ+lHQLQBkrJgo6KaOPMTD19DfbAkHXg:M1uNGreW+pI45Us5IHdHRusqBMAm4KC+

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2292	msedge.exe
2292	msedge.exe
1740	msedge.exe
1740	msedge.exe
4816	identity_helper.exe
4816	identity_helper.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe
3576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe
1740	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1740 wrote to memory of 680	1740	msedge.exe	83
PID 1740 wrote to memory of 680	1740	msedge.exe	83
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 1904	1740	msedge.exe	84
PID 1740 wrote to memory of 2292	1740	msedge.exe	85
PID 1740 wrote to memory of 2292	1740	msedge.exe	85
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86
PID 1740 wrote to memory of 2556	1740	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\850be4a4763e365e983c6d3eb53a5e98_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe024c46f8,0x7ffe024c4708,0x7ffe024c4718
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4752 /prefetch:1
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2196,13324528411435979585,8486116460272185690,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3044 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3732

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7211c812-b2e0-4db7-99a8-5eddfd18858d.tmp

Filesize
6KB

MD5
cb5901675f037380e9f26350f27c5751

SHA1
6def6d0490544efd4d5b56814d8abd250a762c36

SHA256
c4cbb0ee14b0bcc14daa046e9dc324bb2a16b78d7c79aa8e61ba225f42889dd1

SHA512
87125df9719a7f9a02c8ea1392565b9fd573384e8cc8fd45aa721175f77324abf7ae15fde7b08d03788aa06ee1c24fac789b3d4d2123fa7fe5853583a5a04d87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
23c230b45cbe783b497b5f72cef3b0ea

SHA1
39eebd1dacd6c4b850b46d5aa77a1535e814d841

SHA256
6e0539abe17025246a34ff01e94273a86fb9ccf852fe4f492c29972840cf17cd

SHA512
6a51b52817cd3ec7202a9639bfd8fe0178eeadd4d690ecc67526228c151f9af708fa8f1d0b075372cb036c6e08fb23579756686d6d8a63f994a1001576db31e8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
dfad1a953178bbf81a415cbd7349addf

SHA1
8d6b135ff89eaedffc05eca17faa6f6d1603fb80

SHA256
9c3ef1dfbdda3883dfdee871c7f29e8acd4e6cef3878e97ee6be5746d8f75456

SHA512
a0d74f0db837d113d7dcd3e3d8d8e1f2966753bd1416ff0b84102da179e4d050b3e922818fe25c7a8ab76bbc11f464c701dd18d046a705a3df20860d049f72fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
30cb8819156141b3bcaa3bbe93ad3ac5

SHA1
6e5f135c6f39e526dd3df6a066c51d6eb52fd96c

SHA256
6d49c5b4c2ed3c887f5243d52526f57897f2c76131b162bc6f02e70de472ed8a

SHA512
6d7a8f40f90edd2ae8a0cb31578d0330670d5bc6fb5276fb274b6258f04d23ad71ec620baf5d46966458b2372bf076eb4d669191b91e98c0335a9385fec0b6f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6d80877125cb2b2ad4e76f14a70535fc

SHA1
adb3c6314665a59f2c6535099d8a391664b3f942

SHA256
2eb7e760476d3c5e740da8af7e7fa2bdcf8399b99da0c0125c1ac89a71ce16a8

SHA512
68bba3302c9076979a0550ddf41ad0616b85dc90e14ab6e53af96fd6ecbd86e4e1d3e04edadbfe0ae5f95b7011c3509eeb246c196a53c2a4038051fd2e502213

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1d0e45972abaee920ff96a26e1d38226

SHA1
b004c4df055e8683262bfe11ef58b42099b07330

SHA256
cbf6778c6961f3d9d83a32d1369204003c1e8acfa0091b073a0c1a984dc0e4de

SHA512
000487d11208a01ff277355d43a9ec9898a8984cb312b0d0a2857fd3a6985f79fc215e79c350b8f37f7303f6a94f11b9e2d2928daffe8dc2c92dff802daba084

Download Submit