90b1d711ea0670bbe09780553f1a03f2224e481be5df9378dc2002abd554fe6a

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
14-05-2024 22:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

434cf44b3cf52daf008ba56df9cb1e81_JaffaCakes118.html
Size

81KB
MD5

434cf44b3cf52daf008ba56df9cb1e81
SHA1

e0cf9ccfcb0a18f6b5d218fac41ec4e308e84f4d
SHA256

90b1d711ea0670bbe09780553f1a03f2224e481be5df9378dc2002abd554fe6a
SHA512

1e908838040f818cfab5ee5893b774d639c9582839247ee14fe4f357c68945b50cd0accfe667ffab6a271dc536a8eadb5f50f2bed241730c608b8040cdbf4eca
SSDEEP

1536:XWWwSzdAikc4AikcoZ9R0ElZIrxQZ5pf1foTdx1OFFhz5oYSdammiUu:XWWpzdAikc4AikcoZXZIrxQTpf1foZxn

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
628	msedge.exe
628	msedge.exe
2680	msedge.exe
2680	msedge.exe
2964	identity_helper.exe
2964	identity_helper.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe
2680	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3708	2680	msedge.exe	85
PID 2680 wrote to memory of 3708	2680	msedge.exe	85
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 1368	2680	msedge.exe	88
PID 2680 wrote to memory of 628	2680	msedge.exe	89
PID 2680 wrote to memory of 628	2680	msedge.exe	89
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90
PID 2680 wrote to memory of 4384	2680	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\434cf44b3cf52daf008ba56df9cb1e81_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc114846f8,0x7ffc11484708,0x7ffc11484718
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3132 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3152 /prefetch:1
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4124 /prefetch:1
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5160 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4652 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5400 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3344 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4648 /prefetch:1
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5540 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,7158548052524370815,11504730383486853646,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2152

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1ac52e2503cc26baee4322f02f5b8d9c

SHA1
38e0cee911f5f2a24888a64780ffdf6fa72207c8

SHA256
f65058c6f1a745b37a64d4c97a8e8ee940210273130cec97a67f568088b5d4d4

SHA512
7670d606bc5197ecb7db3ddaecd6f74a80e6decae92b94e0e8145a7f463fa099058e89f9dfa1c45b9197c36e5e21994698186a2ec970bbdb0937fe28ca46a834

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b2a1398f937474c51a48b347387ee36a

SHA1
922a8567f09e68a04233e84e5919043034635949

SHA256
2dc0bf08246ddd5a32288c895d676017578d792349ca437b1b36e7b2f0ade6d6

SHA512
4a660c0549f7a850e07d8d36dab33121af02a7bd7e9b2f0137930b4c8cd89b6c5630e408f882684e6935dcb0d5cb5e01a854950eeda252a4881458cafcc7ef7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
20KB

MD5
397383c90a2d930f866f405747e27466

SHA1
7bb6b5d6cee104c877dc5c3462f61232ffe5b360

SHA256
a67db01d19e15d8fa76e5a075e336e195325d79d277a83aadb6a440acf887c47

SHA512
4357eddc0581e3cd6209646540bf59756cb4035d7dba47d5cb6b0050e6c202bda65721d4e9d644f37e3cd105bc5fa240574cfa96649f01e2769b796b523e08aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
504B

MD5
99a9fc78bbaf93891462058d4d046c6b

SHA1
64926de56cb91ef30c084cb40cd5a96e81bb0e43

SHA256
2f9b05eee7e2d240a73179497d2fe9a946cb6aa6d5d537fd0f0ed4f4769c2475

SHA512
8084dfda270d376190bc1c4f95cc1836dcbc224f397ab1ffb27625431320b49e13f1da875dd8d032976fea16e14138c99d5d3965c242b258862862f7f70951f4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
6d881c2e058a2e58a9a10ff5d245779c

SHA1
dcd42eafda10c31241415703c68d94d67465e48f

SHA256
f07d2fe99e7e7fba46dc47236881cf48b3d82ff3f310e434f9c32c96f3380fd7

SHA512
669ed5e8f2cbdc06b62278522b33bffea69b8aba248ca1890772a63a6c40f3fd2eb2aa9f4d8938d3c9f01d304e13e70f9b3ecb1cf846eb236b77bbf0f6e100c2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
5af5c7a8a96e25faba03402eafd87f29

SHA1
a8cb53d8b1275f560715d1c49d2a191afd4357ac

SHA256
b48082bd229c39c35d256ebbc6ecd55ce5026dc755bbdeda5651c05c0942a537

SHA512
54e2908cb4386949118c47d018e6e3176477d68ecbf00fd3afaafc5dd884314e483f7f9093934024a5d4bdc503d1d3201194a1c11b76beacd6c33084b69ca817

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
aacfe1f13ca18d20b8b6d88762561d20

SHA1
a1779cdf4870a979c3b68d4ed17f7f502a471eec

SHA256
ec1ad935bd3da44a59322bb95cd7d3a736817fccb8a902ee5c51f93dcbd3cf38

SHA512
caa73f9631f07fae2a530ca343b74551fbc00923e3a5d3c8c70528aff49f87d413999bff62a0161284e319cea20da8af50256cbbe09e35be7b0593be82976aa3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
b0df4b364628ade59962494bbd79e6be

SHA1
89a2463e7fd603dc97f0d4595968bc276a19364b

SHA256
b10ad68f7a88cbc06aeba2a5a40489c17d3da3021a88df5eebf70a0cfd921a5b

SHA512
15cc1ca1f93ffbe332d06ccd54e1106f7cd0837fd58faa7435b9ca1c952b50c062fc4e2044ee48471f846d7e2fe2030f781132e2525d9a5829144afef9bcad2f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
4c234bce1f998e91a1aee7a597228edb

SHA1
7ce42d95894c8c6844fb37cdaeb9b245c415a429

SHA256
70cc6be5d48a27ff293f0cd622a10907a6e22c3baedf85bbffc584aec19046c1

SHA512
8b5c6b14e45bf86d528e19c27b78927881712a492e9e7cc5e4ef42dd2bb8eaa61a5c7cc7c83268123b94de3c8599b47f70d3d1537b091212666407e6d036abf2

Download Submit