067ad0893bc074a84bc8408cb3510668a9fe78c98572a4c0f78c743c9007e339

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
29-05-2024 19:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

81badcc99f762f380e8246c001eac34d_JaffaCakes118.html
Size

15KB
MD5

81badcc99f762f380e8246c001eac34d
SHA1

857c15cd1d2b1499c1f3cb8bf79b453ab2e7b89d
SHA256

067ad0893bc074a84bc8408cb3510668a9fe78c98572a4c0f78c743c9007e339
SHA512

d29eb12ae8aac740fc1cc91b88cba3def9757eed7672b7f26519ade3755ac416f860414c97894c065f2fbd0ca88cf5685193c4c6aaa6856a0dd6e62ee5aad433
SSDEEP

192:sYzEuR4+fu4H40S30/DNlyddLZYN2yddLZv:BzEuRnuALE0/DNrNF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
5024	msedge.exe
5024	msedge.exe
1416	identity_helper.exe
1416	identity_helper.exe
5968	msedge.exe
5968	msedge.exe
5968	msedge.exe
5968	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe
5024	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4908	5024	msedge.exe	83
PID 5024 wrote to memory of 4908	5024	msedge.exe	83
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 1528	5024	msedge.exe	84
PID 5024 wrote to memory of 3820	5024	msedge.exe	85
PID 5024 wrote to memory of 3820	5024	msedge.exe	85
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86
PID 5024 wrote to memory of 3424	5024	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\81badcc99f762f380e8246c001eac34d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9278146f8,0x7ff927814708,0x7ff927814718
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4896 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5736 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5752 /prefetch:1
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,8530933982230261189,115101135749445309,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5968

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2320

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f61fa5143fe872d1d8f1e9f8dc6544f9

SHA1
df44bab94d7388fb38c63085ec4db80cfc5eb009

SHA256
284a24b5b40860240db00ef3ae6a33c9fa8349ab5490a634e27b2c6e9a191c64

SHA512
971000784a6518bb39c5cf043292c7ab659162275470f5f6b632ea91a6bcae83bc80517ceb983dd5abfe8fb4e157344cb65c27e609a879eec00b33c5fad563a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
87f7abeb82600e1e640b843ad50fe0a1

SHA1
045bbada3f23fc59941bf7d0210fb160cb78ae87

SHA256
b35d6906050d90a81d23646f86c20a8f5d42f058ffc6436fb0a2b8bd71ee1262

SHA512
ea8e7f24ab823ad710ce079c86c40aa957353a00d2775732c23e31be88a10d212e974c4691279aa86016c4660f5795febf739a15207833df6ed964a9ed99d618

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
456B

MD5
ffa8bb6d1651e9e61e5b3e21ca509475

SHA1
6db5d3b9f1e84d89ace14a5f73e5c816b8724b8b

SHA256
7499e4705efaf8c20b3a7d29a0006412b105bbd400b453a562984dcda7419bda

SHA512
9b5ff64d803a191a946d10bf759949dc6fcb1097368beee010c30c565f31a3c1f92311d9bcd6ad8f6dcbbfcf3788b7372334e2cf34903351a81932a6db6edd7a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
ae3555e36de6616bb3742fa3e437a1e3

SHA1
dec2eb86d36867a032058bd09f2cc2c8d375c842

SHA256
2c2f4c74999b6ff7bdb4189c4ff634a3e9b21bff50c38d25fba08fb9eefd5dcf

SHA512
70b22b370df8d4c0112e3bdc63fe402c2e80b539d35bde821cc5a815231579a42d118366f563dea3b09f46fc644456c5439a5e26a8574cb64c27dfc0eb024df7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
261cecffed22fe5af190df8b3b362fa3

SHA1
541876b636da566cc8a707477e6bbd05fd5366d9

SHA256
06b47d412fabeeff6c7661a9118d7f55c66cf08122e6108330a2690903fdaedc

SHA512
a0067f416777c49d636e5f43271ed8881de622fa23ca9607ab69ed44edfef20b5564d4ee49a49f34632de83fda22351d702b6324b1a0a4c07d6dc7be6d0a9c96

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
250d5725f8dd8ef9fc1050d71128462c

SHA1
29093697de083acba44bf5b19b8f207a0b360c96

SHA256
f04f5b4fcdcf35910e82809b26a74a1ddc07774d00f170f132ad83e08193ae50

SHA512
2f6e0bf10535cb0cb77298a0997c0dba54ea926e584024418bb8ec95a257a642c2d365ce0ef06aa0c21adce27d8e28e5cc212a8953072e3bdef3c37040b0fe52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2c1d6fad31ebbc5de7da5766d90134fb

SHA1
70669bc240e068ef11c01ebc680258d26668fb23

SHA256
2a3e0aac6aaab1d0c54c0983c90d5612eec6e0a9a1277944f189586188d0a505

SHA512
ee5c4820dca2a07fd07cd277d7de70399736e27742e0292c4f8feb1c7f60f774e1776f92f409bc91347e24441af49275d7c0cd090a0cef7dd12b358b0f5037c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
96224bba52cb3b941329dadb5368a498

SHA1
df3fd0f54cef78f3c1985e9211cefc2eabf7d3cf

SHA256
8f1d35adc323bfdae2213e667392e8e735166ab6407a7352e42a2fe4ae1f59fa

SHA512
41878a5606a38e624aea64e4f42d00c69c1432bcd206ebdc0dcfc214054f23fb7acc97e87e71816604ebb2fe999a4c62bf8885cd2c2207a8fd3d2ff5233fb054

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
196dd0221387809106eca3b6895f82e9

SHA1
3f2a42cfeb23f27ab8931b5f180bb08953ad85ac

SHA256
ae2dc98d6473434bcc54ac025d5842280d32287183df706506aa89f219be0474

SHA512
500f3336611d851a76781347c1986f361b0c2b4a40864454b116197b449ce1aa24bf5fad603382f99d4b765899c81f5ae4bed0d3b6c45d3680146c0c963c43bc

Download Submit