7bd774e9b5670a42d9df3436534f57f03a70719386ad5d4d623dd7304b40c2c8

Analysis

max time kernel
144s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
27/05/2024, 19:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7a38ddc82068e7db6e2276eb178697ca_JaffaCakes118.html
Size

79KB
MD5

7a38ddc82068e7db6e2276eb178697ca
SHA1

6717bdfbac1d36b4be0993d38d6733e2adc89571
SHA256

7bd774e9b5670a42d9df3436534f57f03a70719386ad5d4d623dd7304b40c2c8
SHA512

ab3abaa904f68f1818989da33966a63db2e8531267bcc70d0221aac015fd93be0eb39f23a7b03425eaebbbf83a977b34b7d9f061d3de1a38f20535a936351834
SSDEEP

1536:N8WXEijZeqLbEijZeqL+1Rr+bO/8xOIwOUTOkOAueTP+MLFf0:NnXEijZeqLbEijZeqLaiy/8QMnzAueTw

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5952	msedge.exe
5952	msedge.exe
1020	msedge.exe
1020	msedge.exe
1000	identity_helper.exe
1000	identity_helper.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe
5308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 2992	1020	msedge.exe	83
PID 1020 wrote to memory of 2992	1020	msedge.exe	83
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 4196	1020	msedge.exe	84
PID 1020 wrote to memory of 5952	1020	msedge.exe	85
PID 1020 wrote to memory of 5952	1020	msedge.exe	85
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86
PID 1020 wrote to memory of 1144	1020	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\7a38ddc82068e7db6e2276eb178697ca_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa1ec946f8,0x7ffa1ec94708,0x7ffa1ec94718
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2280 /prefetch:2
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2844 /prefetch:8
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3356 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4744 /prefetch:1
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6008 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2268,14190038705172875372,3767367791323155603,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6064 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5308

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4964

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
b60dcb8e7f90ab8f93860fb3d37a874b

SHA1
92961f9b3877fc28b3746289141c933628a1e86a

SHA256
d4b0522df229ac86feb44034b85976ef2409280cc2ae06f3d31b04669b96facd

SHA512
83cd469d4450d4d4cbaeaf97cbf8984571366eaf7a9cea48761f142817cd2f4bc72095464c72e10a99487b5fef8812ee87c6bfd00039ad6dce1f28b3adeddded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
7476d40815a2f0e99c5fcba07924ec27

SHA1
357d6b060ca2ae50f399423618181414241def14

SHA256
a70cba1765e397e7a075a348a5736ee55878eeb4cbf1d6e548cdbd788f556788

SHA512
933753381e4271803e7e5b782e214ae053931c514224058b0e951d32c0b3e7c2a00fd16fc932c1ab1f1fb82d76a07052bd6e7819db52973d968585e175add110

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
4d4f0d5748b06754a3ccf404ca652fbe

SHA1
15b6835fefb066e213bd4a32611533b5add65b1a

SHA256
9596f9d735abf7bb88185fbbb9ed6a0726468e22cf2a3863e3ffc7303a6be062

SHA512
749779672ee0c2b2211ae3c0c46dc76796d5a404f3f238524ac9ad55aa410ff6212ecb60a42854726f9694c30668993e234cbc68a9d95080c2ae496c77f9a386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
20576d0e0b93ba73de198ffb5b01e4b9

SHA1
da73192cfc2c45db509e19d5b41ed41c7936ca92

SHA256
16acdd561fd05b10478361beadb136efa5392a7375c94ff8f9bb11fb52327650

SHA512
eea6522a67bc6e40eb44b98855eae6a8a88da32cb684c845f8a0c12760b45840fa4f6af9596459d0de87dcef35effbbcebbba80ea1006cc59ce85423af9a5c33

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8a5eb73b45c46de2938e0647a6dc930b

SHA1
0a1e5316a2c2bbfa07aa8b4174b65012e848f987

SHA256
ce0d6f8f39ea736314d741359ed9e10abc681fb4bc0e4a724c2172882d47cd8c

SHA512
596cda1f450a46debe23b669730d1a6b366ed7cb7602f5a055681e28eb1752e74b65888234a2ee0f0a4ee27c2360b762482b4ad4b6cfefcc358b7f4e5f242886

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f784e7c39215735cbb5ef00e57f79bd2

SHA1
52139608e1b06c1f2966bff4278396f5aa5c51e6

SHA256
405b7becb6fb08fd50410e62e36c070c22a724b2908fda7272cc86f423d2958c

SHA512
987fdc9dade8dd4545da4d0d587aacbd14802910f0080bab973c24f247827ffc9ea8429c12b8eaf967ddc80ddfab9ef123de7713b54053648e464f5a235eb706

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
bd006948040bc8d21d69b4a1971825a7

SHA1
07ee9d3265c8181eb8fe37cfe275923baac25ae7

SHA256
5a04faea2be3851d5c45bddd9957144fd2b464524384ebbee02129ee22bdb767

SHA512
c74f55a684f8495a9219dc5ff5c6bcb04cc589b84bc576e6f9131e7d088c279cde19cd5f2d65359c08aeb9c3ef8e27f8c7f502dfcef7d0dd2813a353b4bae339

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0419794d5a5291a660f5b9b31bff1174

SHA1
742cd44dac6521e933a1cd26c15bc30fffc433ca

SHA256
43d88e2a89800719a68604f9a6a188d2a302ed62cb74b4f33e4bacf147034330

SHA512
b71ac06a813777e4fe382e0349bb498d0afeeb531d4f0ffbb9552b91e32ac029485fb32edc85637ecb9356d9249993128ad500047938d224206477ff4bfb90c1

Download Submit