669399f34b403ee988aa0a1c8d54b5fc2365e0a32363cc3cc5fb5bacb206b6e0

Analysis

max time kernel
148s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
22/05/2024, 23:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

690a6c8e406d8642124fc80d13005897_JaffaCakes118.html
Size

47KB
MD5

690a6c8e406d8642124fc80d13005897
SHA1

92141b8ef750871a7b9ef6285c9d60d58e477125
SHA256

669399f34b403ee988aa0a1c8d54b5fc2365e0a32363cc3cc5fb5bacb206b6e0
SHA512

a26d80a641f82f0ea44e5182d12ccdd21399db422dc333faeae2494ae88b488342dd07d4e35188bd6f82b003bc3c6bcdcceb9e4227e2ba20b2caa7e7000afbed
SSDEEP

768:AB5E8XN/NAGKgvFFvFEZ0wvfPMu+b+/axE+xZPrcTALD5M:AMG/NAGKgvFHEWmfUu+b+/cEgZPrcTAi

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
768	msedge.exe
768	msedge.exe
1392	msedge.exe
1392	msedge.exe
2404	identity_helper.exe
2404	identity_helper.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe
1016	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe
1392	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1392 wrote to memory of 2904	1392	msedge.exe	83
PID 1392 wrote to memory of 2904	1392	msedge.exe	83
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 1848	1392	msedge.exe	84
PID 1392 wrote to memory of 768	1392	msedge.exe	85
PID 1392 wrote to memory of 768	1392	msedge.exe	85
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86
PID 1392 wrote to memory of 1224	1392	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\690a6c8e406d8642124fc80d13005897_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffdc2ac46f8,0x7ffdc2ac4708,0x7ffdc2ac4718
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2908 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2112 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1712 /prefetch:1
  2⤵
  PID:2336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2116 /prefetch:1
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,374140408790674787,14487046042875270087,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3208 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4508

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
664cb28c91f8f34cee0b0e08b117f350

SHA1
530fdb547904d0cf200c59959b8cd31b51ccd986

SHA256
72e0d85c623d4eefe6bb939166161a1fbe768f503cc09b76c87d8de31fc3b8ba

SHA512
9fbe0053018861ad2d8eced9e6cb181204656ea4da245b11c5ba0ff885db899365f34aea3727bbbe0d8cf4695b3c815b12d6d5234e3fb3dd865417d64ff55d3a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
718B

MD5
e6fdcfd11a9630a8cb957609cfb12c0a

SHA1
278603cc201c38700e3a82a81561c21a03ab85fe

SHA256
a24e2bdaee328826ce170a29dd8bf38bb2561d30250898849bc3bced72597626

SHA512
be771f44c9983bc6852a830f208f9b8427651aa2579905652fd98e2a51e91b482d0bb22fa70c923a3dda2f478e703bced6a30e2595cf2dbd832a74a6b7d945e3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
483B

MD5
b99735f40ef9169eb7bbe196a2c6c5c5

SHA1
de61f456431e8bb5589bd547653954d5b9375cec

SHA256
ba94c32c72a20795ce65ab57cc57a4f4da51038e89e2cdd2f32e8af09cd45f56

SHA512
b4efcc7a89c5d8bc2fdb6572cc9ece418c048a25285b128d1da6b20696dd449b5739f3dd1e93504ee4b84f36071a13b3348ba6064540dd57c052d2170e0385b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a11566ce1190717f47c0a4cb5d0b0bc6

SHA1
01b97b816cec5e1c9578c78107c18878caebce72

SHA256
ef03f03d49c278d32d5c4e70023f3916a7ede1c5009c8ac74a202bb79a8af4cc

SHA512
41c7f14a5d89377d45e15d77df6c6aef82c4097b8e062c459d6b64562c41aed77aeccab445c140ebf7cc4a05eeb6a3496a07d3d62a62b1978c2296a146688fd5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fa1b61710509755d44fb5824726f01d6

SHA1
bb98c2487e18d95fa0aa8e084c75c95507441ebe

SHA256
28172608f898d9d4110e4c509820f16880b8e07e011faace8e3482565da8847a

SHA512
22776774d92e191ed97a6fbbd20a90708e53b94245bb1ae9ffc3019143fd49e1dd300f914dfbfa56f0140d726784296c3fa7422425ae245fd4b797e54aa77a60

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4300e5e18eebeb6f7982b754f18b790c

SHA1
23dafb3b324b5534859c9759b4c682aa092e309d

SHA256
b62bdd4dfcdd38d9f567de0ec04d9df0078d52f23c7f3bdc12926e56ecc2ab98

SHA512
3b217a3e5e14e22ad19f9b50b4791bb63aa05ba91606219d363591477b0b6beb1a71ead856732fb9a342f849047c075eeaafa2f9f5fc708daca814ffa6fcd23a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8f69a9bf8a5c4fb118b58edcc99a0eaf

SHA1
3b592ad636b6b6eb3a3837fe8801d8844c94e0b6

SHA256
7cf31d756a7773bdf6c8f3790027c290d82aeef10daaf51ce25aa70e532c6ab0

SHA512
82323c284f9f57fb2aa7c9eb78957e1cb9844583126915d6769baad00b8ef2b1c81d6c21e3e7256c36882b2ddbc0547787dd4bd60dc2b9811499df1608c3d28c

Download Submit