3be1d7fbf7ca81f2607a30c77313d39e86c07750bdec498c759124f01be93904

Analysis

max time kernel
146s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 12:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

12c85e29def51481de9d9b9760638ff0_JaffaCakes118.html
Size

47KB
MD5

12c85e29def51481de9d9b9760638ff0
SHA1

7bfe8c05c13802580cacfd50374da79610db01b9
SHA256

3be1d7fbf7ca81f2607a30c77313d39e86c07750bdec498c759124f01be93904
SHA512

19877db934eb591b15676e819b1f9a82031ff66367356ce9dcc55104aa472f07d71d2cced2ec791c0251cd16c3edb8b3315a992e66fb16830c4ab028da944a33
SSDEEP

768:TgOriWNcaSoagGnVwfJVk8cONsSVEXXDFwNv8Fw29vef:E/pVwY8cONs+v8FI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1084	msedge.exe
1084	msedge.exe
2560	msedge.exe
2560	msedge.exe
3228	identity_helper.exe
3228	identity_helper.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe
3564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe
2560	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 2304	2560	msedge.exe	83
PID 2560 wrote to memory of 2304	2560	msedge.exe	83
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 2800	2560	msedge.exe	84
PID 2560 wrote to memory of 1084	2560	msedge.exe	85
PID 2560 wrote to memory of 1084	2560	msedge.exe	85
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86
PID 2560 wrote to memory of 1924	2560	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\12c85e29def51481de9d9b9760638ff0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9475d46f8,0x7ff9475d4708,0x7ff9475d4718
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7124 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7124 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7116 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4900 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6952 /prefetch:1
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,767149784415493602,16745636690187748799,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6236 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5076

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2500

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
9480f2913b85d73a42ab7aa448a958e5

SHA1
eeaef5e322471fe3017004b9cdd5c982d768de29

SHA256
2004ffa808df00b854e1f1bfdcae61f7d4dc829154479c8e6a6bb21c7711840c

SHA512
6bd64f709bc26ba37174572364ff4203d50ea7c177f8c6565c4a11a04eee60fbda8822a78d730d1080feed34440cd8e296dec3c153afe0f77ce2c9156570f4dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
0caeef521389b592403feee601177bd5

SHA1
30610a31aa37d145687385efcedd2a17784caf03

SHA256
ba1b3e34ae30a6f8fbe748e5f07f25bc65b402d3d51feef470272087d48be67c

SHA512
79dd1ac8147666367a01e9bec56b87ca814ad06acd8a2af9528892f0785fa71aaf2ae555e8781d6d6e080fe4558f59c601fde0d3bb2860b48a90c85cf21a0ef8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
896784972b38bf190fa9029d265db076

SHA1
3b40d1115c98669f2a78b6c22d600b19d41cdada

SHA256
a7072ea9ad4e5f0bb075b77c75becdef2298f2ef94bf8e547a12c36fdddf47c3

SHA512
7e822547c55652820890ab3c701dd7ab431bca5aab95362b5923f03ecf6fee9fb935b272bb132a54854d9c11fdeb255c3c96468f1024ea7734d1e83f5fb2efb9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a3f28c58d7e2a7da9f62c620b8735a34

SHA1
ab06f55fa8ea9101ccf67a9489110ea98fd4b6d1

SHA256
66b0e332c26b34db55a82aec5f959e292fd3ebb7da71a08237913dcf79dafb42

SHA512
0d0caab04fb3115f04cf681ca692000308db8a47725dbf710ee4b5575b0f67b349930a105e4d72969cb3a2e6cb47fe9364c00f20d00fb8903002fd888e222336

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11e3fc9f902b1d56afc39704f9c47983

SHA1
f493cd67f6f29d34bdd09f28d320cda582668eb6

SHA256
7c812b9c6a5fa125d1fcd9594e75ff8db3dbdcb5fbe6d9ccdb4ce2491a03bbe8

SHA512
21a7ec5b20509d89ab7808782643110eaeb08a6d4356e51334d38b60300edcc539f82622876169a86871093d9dd4222d0113f5839f87067986d90f81400b3b52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
93f36519ae923c85d9ddf2df4bea85f8

SHA1
b99e177fa7e8fd2218a4e36387a23879455976a6

SHA256
09561044268616bd0e28a37833d0799b4781420acb6e12274cead8dc93b020e8

SHA512
8f6023926d580bdd0478edcc59910404651830bd3fd622f88e01884793fda670b80e16823dd6f04ed4f0ae340b9eff23448c0030eb516d12e1ab3173ae6a9ce5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d6120ea335459f357889bb8e374631e0

SHA1
c198df77c32e32c2ed1e6bdad84ca8ba1fb851c8

SHA256
20a6e899c447a319706b836d6c4e90a79ce1d15ab254cbe9c5f6b6f5242e3d09

SHA512
0e7d7926783cdc68d311f98cf1a9d77db3a00fa5821fd0b9a83f8759f983aa65627863110100415e2b0b35328324e163a77636cdd85cd51ae602ae52ede16c98

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2e4347b502d957524504caee269eab74

SHA1
879ffca3468933251c92a2549531f0e2836fde2d

SHA256
e93fc57d058e3c2882da6297a9742cae79c9f52b18b81ac0fa34c317a6479e68

SHA512
5ccb2cf2f4cfd28e10f88f04399e252f1c985e50f0dae5114900b4408b964887bfc689a747d2f16f75e493012266e52f3337aadc008579eeaadb3ab91252c22a

Download Submit