f9e93bdfe8d1daad459f6088afce1fbdb8505561239078fbe4d3ec4723ca258e

Analysis

max time kernel
146s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04-05-2024 10:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

126204749c8d8280a6326e40c32e477f_JaffaCakes118.html
Size

94KB
MD5

126204749c8d8280a6326e40c32e477f
SHA1

3745e11280d43e4027d0ff0d2bccc51ca3e127e4
SHA256

f9e93bdfe8d1daad459f6088afce1fbdb8505561239078fbe4d3ec4723ca258e
SHA512

acba59e25088d6d26949aef01226ca15c51c9c8452e223a45a6952604f8327eff2b808712f4e463f4548a21e5a5a65dbf84ef598684ae48fd8b649ff87bb6bff
SSDEEP

1536:xZGIpB/IFa0o66g1tdHW4N4fKVOfvKn/C+OmuX1:xZGIpB/Y4m1tn/C+5uX1

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3852	msedge.exe
3852	msedge.exe
3028	msedge.exe
3028	msedge.exe
448	identity_helper.exe
448	identity_helper.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe
4184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe
3028	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3028 wrote to memory of 3388	3028	msedge.exe	83
PID 3028 wrote to memory of 3388	3028	msedge.exe	83
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 1424	3028	msedge.exe	84
PID 3028 wrote to memory of 3852	3028	msedge.exe	85
PID 3028 wrote to memory of 3852	3028	msedge.exe	85
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86
PID 3028 wrote to memory of 3820	3028	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\126204749c8d8280a6326e40c32e477f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb47a046f8,0x7ffb47a04708,0x7ffb47a04718
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2372 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3328 /prefetch:1
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4920 /prefetch:1
  2⤵
  PID:428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 /prefetch:8
  2⤵
  PID:5068
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1904 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2852 /prefetch:1
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6492 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4788 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7132 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,14302764603023795882,11978303254036046695,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5528 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4184

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1284

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dbac49e66219979194c79f1cf1cb3dd1

SHA1
4ef87804a04d51ae1fac358f92382548b27f62f2

SHA256
f24ed6c5bf4b734a9af4d64e14a80a160bea569f50849f70bf7b7277c4f48562

SHA512
bb314d61f53cf7774f6dfb6b772c72f5daf386bc3d27d2bb7a14c65848ee86e6c48e9c5696693ded31846b69b9372a530175df48494e3d61a228e49d43401ad1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9e55f5864d6e2afd2fd84e25a3bc228

SHA1
a5efcff9e3df6252c7fe8535d505235f82aab276

SHA256
0f4df3120e4620555916be8e51c29be8d600d68ae5244efad6a0268aabc8c452

SHA512
12f45fa73a6de6dfe17acc8b52b60f2d79008da130730b74cc138c1dcd73ccc99487165e3c8c90dc247359fde272f1ec6b3cf2c5fcb04e5093936144d0558b75

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
40KB

MD5
5c6915af5fc1a2f3ade5d21d864d650a

SHA1
7459091b99d32474141b9a324bed7c2831353d5b

SHA256
1c0c57ffa35d64b3606683725c13ae67e58456253e99030e444d6bbd46d6d698

SHA512
ca59484c79701a9e1c7c57d1c6047eb79c746354c081f6a19bcdac9479626255e09b9b357d9d1cac830c386ea32443cf677b2964bed8b2a55e3670bcf7ddb16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
570ba27d998acd8b34ce65bf8ccdb84e

SHA1
06ccf74c512422d192214dc974b6799e1caf33c2

SHA256
771cf25baf6383e2d4e640de065049e284a6594d22e2824dd37d5c76069fb4df

SHA512
8b25d361d0f15734ff25dd7ee2e84e71df6224030684fc687338946954073ef4253d32b13eaa4ba1333de92d7db2e305946aa9755fbfc2c01cd33fd9e94fe9b9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
c9aae8221f1fb276f074998fd02f3fcb

SHA1
5f8e63fe6cc8da245e408ece4b1ed6f0e88108d7

SHA256
6236501f7cb7322751254a90248c20536f674cf56734c21880d9de14ce458358

SHA512
7eed86c9f178a6af7792637983fd05c4a229ac7fa095150ade665971ec374a766279ab4d1d29f1e1913adbd5a79dd8643de067a14d32b7db2e7dbca26897c8d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
4978644d696d133b825efc67540125b2

SHA1
b1227e429fe657b68cb40692da7e9bf2978a07e1

SHA256
f31595b8800c23b540b3b5b55bc9afe86736b42605eda09fe61ced43d1574c42

SHA512
6b516636f177def12cedb12d10832b804dc2d9324c111690d49b69df2f201c7adcbb60e384021307312e89c82b5118d61a7ef3553c7b945b734b219573ec1329

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2ca9bb20148570da93feec2677acb516

SHA1
4d44116df9ed8b314d0dead91be6ac52c7c32d0e

SHA256
846249dab620d2c1438b63d2f4dc355b2ec53149969060abf469037fcacee52f

SHA512
c89a578723700a48e0e662057384e94debf1af52d81182ec457b46fe7cb629983291183787d8563e24468726d31aadfcc7a779852d8d17eca0dd3e2ff719c2d4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2e9a93f2f04c86158c876f1f740cc6d4

SHA1
95793a0311d784ec5852d7d0fe90c21167f4e602

SHA256
7bafaabec293d60766c1fe25d1193699ded6304ebf00a92ce4592999b18b472f

SHA512
e4858ae9e8ac284cc1c37eb1943f819e4b7a7239bd65e674e0163ca2deadbe7f35ea47ffc53ad0e2af8144afa635c87598c02b9e25d2c3fda48ddc44ed5e9252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
62afbc5f14e469776714572ac4b7502b

SHA1
92aa24167775001df0a57a7aa73a620a89c50be7

SHA256
0672af9241f90c6cf8014ece9a92d3bc8d64255146f39cc2ffbfa5b6ca2fde95

SHA512
3cf34e3937ccf5f4990d3187e2af8e1851ef0595d9071ccd737d83b0bd2750c109d905e052f380015e5e8ef8d9a17dbc6085ba397f1d2249ba6c1742e57ef79d

Download Submit