bbdde4a4e785a9624e947bb80358957eeebbb8af6ab017c392db006f101ce036

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
02/10/2024, 01:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
083bc323484078ae87cc9f439003ac8e_JaffaCakes118.html
Size 9KB
Sample241002-bref1atfka
SHA256 bbdde4a4e785a9624e947bb80358957eeebbb8af6ab017c392db006f101ce036
MD5 083bc323484078ae87cc9f439003ac8e
SHA1 50345db96cae6f1c9d584822ffe5259e1e1e14cc
SHA512 d8a3351448d829562c045d673412cd3a8ae98101ab6dd7da8b4b8ae22a07ea7f19e197d14ed53461722b0455d6aa18872b71c343560fa23a0874bfe53efeb21a
SSDEEP 192:H5zdEbtTJft2TPrWUMYSoLzMBdCQLypUDoX+nCEAXhG5QsgLL5LCBoN2:HFSbGqUMYSUMB7LypUDoRhG5FoU
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
3056	msedge.exe
3056	msedge.exe
4344	identity_helper.exe
4344	identity_helper.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe
3276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe
3056	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3056 wrote to memory of 2784	3056	msedge.exe	82
PID 3056 wrote to memory of 2784	3056	msedge.exe	82
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 3236	3056	msedge.exe	83
PID 3056 wrote to memory of 1788	3056	msedge.exe	84
PID 3056 wrote to memory of 1788	3056	msedge.exe	84
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85
PID 3056 wrote to memory of 4840	3056	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\083bc323484078ae87cc9f439003ac8e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe899d46f8,0x7ffe899d4708,0x7ffe899d4718
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2128 /prefetch:2
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2452 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2928 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:1468
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4044 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2108,4072426800734857438,18361664448567634030,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3096 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2956

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2156

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc
MD5 111c361619c017b5d09a13a56938bd54
SHA1 e02b363a8ceb95751623f25025a9299a2c931e07
SHA512 fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2
MD5 SHA1 SHA512

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 152B
SHA256 cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c
MD5 983cbc1f706a155d63496ebc4d66515e
SHA1 223d0071718b80cad9239e58c5e8e64df6e2a2fe
SHA512 d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 360B
SHA256 0c666d9f5c420cc8ea1d14f8235b61fa70c3023542089745d1899b793a0845c1
MD5 6c516009120f5b6d080246a069e995c3
SHA1 0d17c650c7bf521872468c3c4eb1aab420d1b3be
SHA512 a6cc86a79124f95872bcac2b3a1b2bb3baf63fa8a01b7c8ed5684459606267383cbaea95a0de7b3af932317a014111b6201126980352b00399e9fc5c3b67a4e5
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 1KB
SHA256 4480b3d55668dc60660b6f81b60380a91bef4a3b3ea66b09a70bd500aecd848c
MD5 f3a04aef4e5f0ffc1cab69e5df0e9316
SHA1 64dde9700d7acf5fe4e21cca4ff11d8a59bf9f11
SHA512 184a109e8de254af4e46052b6f86bc36f1a5442369560410cc4fa9900ef499037c6b288b7739d91b25c55ec254fc2c5da629d643528794f15ed7ac65d6ea0b8f
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 5KB
SHA256 ec2aded28f9e7bb97d54c20fb242a2a1232a08def3634d1e5a1994fe910c1bbb
MD5 f090195f2e5c74d07ea5060110853369
SHA1 d6d82a4e5ab09278daa38e014b5e384ef659c13e
SHA512 9b9cee009c9dfaa00f6ff354551b079b2365057e6cf0a05f3ceb07635458b49e674c251ed56f43963de6c7cf224a67b003de462acdb86a75d1e03764939dfa7c
SSDEEP 96:nwkX2F1SLwbwpvWMoiVmdeH2FYoUWQyV+VDCziEwb:nwkX6u4GWMX9oro
MD5 SHA1 SHA512 SSDEEP

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 6KB
SHA256 abb20bcbdc168df19cc10b2c9eb42d2352a3ad1f6a0564b2fd1ce7ebda567b76
MD5 cb3ad2e69d3dc6aa6e1ef7efad33b549
SHA1 9db70599a0ae9ecd829be6557d11ecaeca8c984d
SHA512 65885fe976c1edd07a856712a9eef080e12941b345cbb83e33d314e00f388ad8ba8b6c36fc57017539c4b18f126919706b2b3739689d80877faff9ac87004c3d
SSDEEP 96:nwkXoF1SLgbwpvWMoiVmdeH2FYoUWQyV+VD7AiEwb:nwkX8uIGWMX9org
MD5 SHA1 SHA512 SSDEEP

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT
Size 16B
SHA256 1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167
MD5 206702161f94c5cd39fadd03f4014d98
SHA1 bd8bfc144fb5326d21bd1531523d9fb50e1b600a
SHA512 0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 10KB
SHA256 bbb93fcff96722e67d5ecdee8ce1ce4305e726367f3f7a5f8d8f671a6f6ff12a
MD5 9e7db4fd5081972508074f9256c985a9
SHA1 6fc9ee194504b4294ddb4e3c70cc54de9dbd23c4
SHA512 eecf893e627d63c07c780e5969c083f246bb6bcf55315c38801415d5ac776363850a957f9a41e97d26c0260098ee1ec83efa2b7caa111edca50647146aeee7ae
SSDEEP 192:YoCL/Pgu90RZj8Sr6FA4ZiIxuERzA83h09RZxAexupr3e2RU0Yd6FIcM/bo5ZxO:A9iIxuERzA83h09RZxYjLvWqZxO
MD5 SHA1 SHA512 SSDEEP

Submit Download