845cb5641c4827f4b5f3321c3352d0d8777b472cdbde06932634b6f83ba69e53

Analysis

max time kernel
147s
max time network
160s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
08/07/2024, 01:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2a91b9c47adf56c0cbd208875ff627e8_JaffaCakes118.html
Size

195KB
MD5

2a91b9c47adf56c0cbd208875ff627e8
SHA1

b3e903dc3c03df2efa14afdd66e29df0875d365f
SHA256

845cb5641c4827f4b5f3321c3352d0d8777b472cdbde06932634b6f83ba69e53
SHA512

7a118f7069bb5d8690ba02db654ceaf9892c3d084cede1967056800bfc07ef8e6df2bde6f30e981fa5bbef638dc60eab8bd8fc1976645516f706b0ab208c65f4
SSDEEP

6144:pjkIII13G4k5QhL8atVFiVQ5MIsuQyf5bTM+MdBXpKgXpgx4t4ADO9mge/bE6zbO:NkDE3G4k5QhL8atfiwMIsuQyf5bTM+MK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
2992	msedge.exe
2992	msedge.exe
4724	identity_helper.exe
4724	identity_helper.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe
4464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe
2992	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2992 wrote to memory of 1476	2992	msedge.exe	82
PID 2992 wrote to memory of 1476	2992	msedge.exe	82
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4440	2992	msedge.exe	84
PID 2992 wrote to memory of 4828	2992	msedge.exe	85
PID 2992 wrote to memory of 4828	2992	msedge.exe	85
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86
PID 2992 wrote to memory of 3620	2992	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2a91b9c47adf56c0cbd208875ff627e8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9da2846f8,0x7ff9da284708,0x7ff9da284718
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2252 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2788 /prefetch:8
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3324 /prefetch:1
  2⤵
  PID:2476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5628 /prefetch:1
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6360 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6224 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6468 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,10948305636052616026,14156680962253497604,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4520

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3c78617ec8f88da19254f9ff03312175

SHA1
344e9fed9434d924d1c9f05351259cbc21e434d3

SHA256
3cb47fcdca33bb3c8f4acc98424140987235ad79815da4f0e7593e4591ae90ed

SHA512
5b58675088b0fc2b2d705cb648ea89385b80c7cf908b0f4f95a9acdbd350b50754e1b586202db6a918eef70029fafb210947f3c43c570ecf7657e08939fd7e9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
09c7ae658385f6de986103443217840b

SHA1
298d880503edce4413337c09d3525f27a2edcd28

SHA256
91e04ec38abdb0204458543592c4621b7bc0306407884f764aa9596a52454cd7

SHA512
4e1272b209487d1e9e7d8502be49ebce91c76718410e817b3ac7faf47d9b699210aab1b941fbb5ddafc192ddf4b2ba151afd47fab753ec62bc0bca36039c55c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\76c560f1-766b-4eb0-b1fa-1f105827166f.tmp

Filesize
6KB

MD5
ece0a0785cdcd0e5fc1cfbe3aa7f66a4

SHA1
f2de274308abe33dbf21380d94f91c2e0b6af5d4

SHA256
2606eacddeca151766de69943b1d6647de9a78863da2aebe12d8d8270cd24417

SHA512
0711614ab395855c42c1da46bee947b95ba9081c1cf31e61428da430cd4f4121a9a29ada65ac9248f10b5297d8b55bdb79d4c34b13da278aa08b7a86b83d16fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7165e3c886d2f1277e24337b1326fee2

SHA1
7e841b4e04da323ee145c7dd952292ac028b06af

SHA256
3d26c49226c8d74faa4706136533605d58c621794ea5d616eeeb16bce15223d5

SHA512
df446c725adf1656b2646c4a8e7ccfdcb86657fb2ec0c42b26b68526d7d956aa861bd9729d443d7b7457d56483b758907d204ad79339aaaf363f3d10dcf57b80

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
d6db2fd0a35e06eecf8341d8cb76670c

SHA1
322e3f46b9393a069b31dd9e46caa7019c7ca785

SHA256
b30da2fcc1607402fce1b34e4c48a73d2adad17e33e4af384d2154de0c681ae0

SHA512
baa0d5808f355209237fd3da34cb6bfa2f0240754631faafa783829a020a5de117086ee0230593802a74068cf0c58ac61c5ffe49638403cc45c476f3584a4b5e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b602512e641b373f03995c3f0416e278

SHA1
b310f7b2fd35bdfc9c8e65e139d133e5a519fedb

SHA256
39b88b6f86dfa5f332753d6b7a6d81140af7e59fc9b4ca38e01035fd5612988f

SHA512
04fe65db71541128001e2116f5586dab005926742713f25f79926313b922d4444e5feb94c41a4791d0cfec7a823689a60a5db726667db074c568d8b5b366b5a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f70ce1bfe42e2388f0f11c5b4e985c48

SHA1
85281a1afe7bce2262268bb06040d8337c3693fe

SHA256
a04272650143dbbb61d12047d2d90da05e9526031ac7efc903229fe31f011f26

SHA512
04a891fda579490dbd7857ceeb446048463d2880116b028dcc097856b5119eb3ed1c5c65f589930147a4dccb9ea8ddeb230c483f513ae2dedd56228e4a5cf894

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
7453756814b5fae36f6526d64df26a47

SHA1
004a4f5d7290826603959caa5295e44e12059292

SHA256
93c7b99fd8f6371b82ec0d585d0aaf654b30c73072d486b363b24406dda38fa1

SHA512
c9adcd818ef4e4b51d10f00a68d701a33531b409b81ce3b460f3aaa010e1b744af390e647068790f7dc422178a6042c635d5bf037897a42180faec7f9d965959

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b58749bbd7233920d301f81432d0d1c2

SHA1
15c2d8d1fa7318446048d6d1749e3f50fc6b280e

SHA256
da9fff0d525de76d7e2fc19606244d464ef0ceb6cac4d17581b989694c520b5c

SHA512
34daf10624a60577870735bd153dd3ee637afaa7b8380abfc11f23fd6a26cac588bd315e81991ee48e8857f03c750284d0c0a44d2316c913488a9fadbff60eb5

Download Submit