527702aee25c7a0756a41e1711b9f133a50d499072d5275bff033fc8a241933e

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 08:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

29db24b22fa41791b8b7332bae924612_JaffaCakes118.html
Size

80KB
MD5

29db24b22fa41791b8b7332bae924612
SHA1

12876619f8edd63dc9d8647ef700f2bd4d2c4925
SHA256

527702aee25c7a0756a41e1711b9f133a50d499072d5275bff033fc8a241933e
SHA512

c95ed32b694bb6703835554bc8d5bc0151c22afaef3941a47fa09276bd8255dcfa9b8aa2351c02ba46f3eb8e11a170c55efb9bfec7ccf0b290e8cebd29a8e1ce
SSDEEP

1536:GesbJf8aDa+N66md9jMGb9OVFlj9rCX7CesI1sm899jl28tVB/f+R2:cbJf8mAhBOjN9rCX7CeLsmYtVdf+R2

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3652	msedge.exe
3652	msedge.exe
1068	msedge.exe
1068	msedge.exe
336	identity_helper.exe
336	identity_helper.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe
3552	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe
1068	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1068 wrote to memory of 3076	1068	msedge.exe	82
PID 1068 wrote to memory of 3076	1068	msedge.exe	82
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 4480	1068	msedge.exe	83
PID 1068 wrote to memory of 3652	1068	msedge.exe	84
PID 1068 wrote to memory of 3652	1068	msedge.exe	84
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85
PID 1068 wrote to memory of 3996	1068	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\29db24b22fa41791b8b7332bae924612_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffa59446f8,0x7fffa5944708,0x7fffa5944718
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2244 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5580 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2220,11440883595597644541,6052291133606016226,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5348 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3240

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:32

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f0f818d52a59eb6cf9c4dd2a1c844df9

SHA1
26afc4b28c0287274624690bd5bd4786cfe11d16

SHA256
58c0beea55fecbeded2d2c593473149214df818be1e4e4a28c97171dc8179d61

SHA512
7e8a1d3a6c8c9b0f1ac497e509e9edbe9e121df1df0147ce4421b8cf526ad238bd146868e177f9ce02e2d8f99cf7bb9ce7db4a582d487bbc921945211a977509

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0331fa75ac7846bafcf885ea76d47447

SHA1
5a141ffda430e091153fefc4aa36317422ba28ae

SHA256
64b4b2e791644fc04f164ecd13b8b9a3e62669896fb7907bf0a072bbeebaf74a

SHA512
f8b960d38d73cf29ce17ea409ef6830cae99d7deafaf2ff59f8347120d81925ff16e38faaa0f7f4c39936472d05d1d131df2a8a383351f138c38afb21c1a60e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
c8445d11567731d9ddc6011a2f40576e

SHA1
fd5633bf2446158f822848e4407dd97c51b8cfb5

SHA256
7090161b4ab1fa123bb994db124dc9e7561a012140a909db6df983a68e6b6e3b

SHA512
05d2625157d5506ca15a0443acf3783097bae6c05d321a46b505b0db138851cddf971d64f850a57404aaad79b2e89ff1d91a4224764a7cf259285975d1891a90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
f50a576a83a710a465aeb1fd33670b17

SHA1
64efee6f438d85fe78f2d79f5f52a7c1feecff50

SHA256
7ad82b17ca7d1f9f92fa49d33d005bdd762d3a3f695719ac6e162cb51093c80e

SHA512
a0881347094f219b35deda3a949a6cfbe49d99cac5b58902b1703eed3433ca5c53aa412fbaa4485d94a22aa3176a65f9955a0b290ea90c69409acc3484415bb5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
749ac70de72c2f230e26e58c2d8dfec6

SHA1
62956340f82da7a5bdf6065d82c2c5099f6e7cdf

SHA256
2f0e206860646a165f7738b3198a717af2b15a59e41bfdfd8ce2780f0ae0ae6d

SHA512
1654355a8d4faee29e17d8b6a71b15bcfa699d292d262b9135825eba7f48398fd958952eea0709b33b2b5de37c417456ef3819cfbbdc3057ae620c232f9a56b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
26fc3590068415cd59bf16a57fc8e82b

SHA1
2a7a5793ce81f2e912506e3b945b40a67066562d

SHA256
0f9e2e2709ae57a309d0dd95c1a550da6cd2dec6a263e05761de6c0753713241

SHA512
d21c0496b7f72e67d12a888472371344ec036adc4b57bf9db4e001b5bbd6b3ee26dc1b0891597e06850d19588f64684f774e3325be188aa882a7f99c5cf8b2d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
461bc56e2e87e3a018d470cd79a37fed

SHA1
5874bd55087d5ccd8e9d4f3b5e01f9598b864fa9

SHA256
a3aa3d5022415bda499c45d047f7e37fa119ca645ca8b6b2496036e9490688d3

SHA512
847fa322e92c953281c2817115c1c2b205c63ab3c66504e6cafded541cbf2b0a8349770cf3f8b516dc21b5ec52b1bcf3c1d5ee01b131651b79da3de5fb03e496

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
522127b43d6b7bb4372d08fc59a4e49a

SHA1
a093af30782ec7ca6662755f378e29b59e653791

SHA256
678dcb7a855b1dca960fcfcb5368c2191516a73f6fe5060d766f5df793969f90

SHA512
fa539e6773f0de0aff734f9a8093f2f697e659a6f13c9a04ea39ea7cce5b417b80c46626154a87b35306957024e00a15d181b603b595f2ab36d88d29acca50ce

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b941778ef666505956983902b766b7af

SHA1
b2fcd7e957c6c063f9d9d4a098ae003714393fb4

SHA256
e9e487893bc5dd0bf8585e0f1580c919764bd179d9cfd984ba0547bb11dcd33b

SHA512
09fb985f239f02c51236b574cb12b09d045ebe18cfbf2d13b28939f2ee39e4ee45f74025dd39a5e7e681103302a130f0810e89a95592eca0d6cd0fc703e96485

Download Submit