6d94460aba3073cd9a1895089d92b85091f484fb9078379bc2555710ded76446

Analysis

max time kernel
150s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
07/05/2024, 16:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

21106739b15c989e558b265dcec8566b_JaffaCakes118.html
Size

60KB
MD5

21106739b15c989e558b265dcec8566b
SHA1

088e40c5f2db50bb9fec363b6ca1b1c89c13cb95
SHA256

6d94460aba3073cd9a1895089d92b85091f484fb9078379bc2555710ded76446
SHA512

c3109b41cf93bf15fc15a8e4cdeb2eb881146eba68adb43de47c09708b21d3a5015e29937239dbe6cc17c82bf8462542ff733fb29125103d14363b0aa995f3c8
SSDEEP

768:7gOriWNca+oVgGLsAoOCu0D/ngktxXrHylwXutDxNGRtR29fcDf:YyBoOCBDIgXODvGRtZ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1656	msedge.exe
1656	msedge.exe
2892	identity_helper.exe
2892	identity_helper.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe
384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe
1656	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1656 wrote to memory of 3888	1656	msedge.exe	83
PID 1656 wrote to memory of 3888	1656	msedge.exe	83
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 4544	1656	msedge.exe	84
PID 1656 wrote to memory of 1144	1656	msedge.exe	85
PID 1656 wrote to memory of 1144	1656	msedge.exe	85
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86
PID 1656 wrote to memory of 1380	1656	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\21106739b15c989e558b265dcec8566b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffec2bb46f8,0x7ffec2bb4708,0x7ffec2bb4718
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2244 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:1280
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5792 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,16918844254212784072,6544896884750139352,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
2d8b09747feaf0aee3bb959b4c4d3f7d

SHA1
8518988845598a2c73f3dd0a6e8287c76ed07f6a

SHA256
ddefcdc19290058bc8068cacd0e18cc07077c3b43fb911e7fa79c86a0ee55a01

SHA512
62a87a30156b6700961f3eb92555aa25b55ae2606cd0e3d7246358b8e0a923bffddc1b7328a0a38786907082ef5284fc1e240e71e71bf56d243b42c080a1c760

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
638e267460ed6b9e092ecece4151a948

SHA1
899c33232afc9c4c0eb0f25ee9827a12266d1778

SHA256
3529cc4dabeed06fc770115b9c996bf1e4775f050acd5175467df201c334773f

SHA512
31a0fcff13d85dd669661bd65db4430e1eddf7d06eea480581c9f27f2580f083b3467e0ec41a3b10fb7e29658cc13109c879edd245ae6037a91fc065cc66cd82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
febad34700558ef93672e8379d41170b

SHA1
b3e925c1a89c2785799a1240b18d01a00d85d8ef

SHA256
25123ffb5e57e91a0f42db729956f4b879b2c77c3783ee0a02e90bdd2177417e

SHA512
222ae38d1360615e5c78583266493551055e45f50878771ba04c55d378c938f092e67bc524d8fa3d743e17ee26c6ea88a6681bb91439dacee3702b29a6aa2357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
da3d0eaccd39aa67aa8f43949b3abff8

SHA1
1df8cc32d5f8dc06728f2632d433cb3e119da029

SHA256
b4e73e21b49843d3168d7114c3ad9805da9fa9cfd9ed0c8711d4b3343d1485d4

SHA512
1622b53a081b117867fcce6cca2dd869606ccf59381f74042281a06b02b4ecd1be8a45d50b756bb6c2ed9501d58cb503cd91219c54bd6c5304afe820685932c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fe7c7d49ee1419896cdf2143f72fcfa0

SHA1
90597e9791f64e5f34e09a0d7c9c9645585895f3

SHA256
448ed47c0b25047a99604fc86bda487966818f5cd854e18bbe1fe1fe84789527

SHA512
1fef6a318c65375ad21be85100f76fa9242fc3e05aab93146ac03395eb148f68e8c565b1997f4e2d9319f9fec8b61bb5378ee76731a2c5535b3b864fde107750

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5bbdbe1e506420f86c55edaabc4505a

SHA1
35f30694031d32737d22f5db5ac5465f360f98a0

SHA256
5fd46c2775b129bd53f77a64b28a2fd9a540c534dc795849fe4dc7093599180f

SHA512
64b7e816724218dc7851f5801c8efdca178d25d1a688137d50f6358213504320b7b6500dcdd72aa8235ad1741117243669d09bb63e908b72da99d85af44baeef

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b6b07f608648f12fcb247731183e6999

SHA1
8dc6862de19212cd5e7dbec662cf5de8aed3d6a4

SHA256
22438b58cad1b162fa83117f09cea748334356fe5229b560ea9d90977799f563

SHA512
9bd30642031803ef80866b0740b4a2739a7c0e7cd346be0da9f23c7b3b12c219879634a2eb832be0a1471dc6b80de1b6dd3bff347da17bc83d32b72165d925fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
dab005a7051bcc4f143b461533496f4c

SHA1
7f83b83b8cb9623a0fb9d77eed55c1369a0e3ac6

SHA256
d49622c99f0536663894901b43fdb6ea50d717613d83b677a8cf07eefeffcc5b

SHA512
3a87dabaa0fafa45481b4e6f29b7006b24a8082782c7d49279bbf9cbc394318dd8d17d8fc51c850962f32aadfc58abb90c79321f1949ac8525e137cc080c9f33

Download Submit