f17c872f46a66db17d4c27878b7bf331e98ed97819bb835df15816527e6bb90c

Analysis

max time kernel
149s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
10/05/2024, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

2cdfd7b69b1ab3f97e5c008e0913c761_JaffaCakes118.html
Size

160KB
MD5

2cdfd7b69b1ab3f97e5c008e0913c761
SHA1

6327a380d8f2d4fcb6eccb7298f857b79198fff3
SHA256

f17c872f46a66db17d4c27878b7bf331e98ed97819bb835df15816527e6bb90c
SHA512

5ac302109477f3b0c57969dc43f58b717fd2560f9572532d201a493c732dfe8170ca8e72bb5026254a6e6e4465de7969da0bbb33cbe6a4c5edf4aee8f68d96ee
SSDEEP

3072:zVPnHTIFUbCGvCu09s2o2skAieohwAlGopktmtxp:zZnHTIqjvC38kAie4v

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5076	msedge.exe
5076	msedge.exe
5012	msedge.exe
5012	msedge.exe
968	identity_helper.exe
968	identity_helper.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe
2384	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe
5012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5012 wrote to memory of 2212	5012	msedge.exe	82
PID 5012 wrote to memory of 2212	5012	msedge.exe	82
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 3628	5012	msedge.exe	83
PID 5012 wrote to memory of 5076	5012	msedge.exe	84
PID 5012 wrote to memory of 5076	5012	msedge.exe	84
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85
PID 5012 wrote to memory of 900	5012	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2cdfd7b69b1ab3f97e5c008e0913c761_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffae6b746f8,0x7ffae6b74708,0x7ffae6b74718
  2⤵
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2152 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6032 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,13415925297611116237,7911575807652347872,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2384

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4340

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000006

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8277d02a5e5edff234ced19f4492cc20

SHA1
ba698e196b0cdfbe9566e6fcee2215e18acb76ac

SHA256
4ed64df202a92fbc9095d56ddae013297585d5459a370bd9628184f2c7863c9f

SHA512
9daa2acf2bf4ef06ba866aa64975db74026d4787e5b35bae95b9b1d45d791d4c2a70121963a0b1eec7c4137e4b12c0cf60d5bda1b58e78baf38c0d4b93dd4f77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
eef5ec4b66cbe070fb25f00ad1de47e4

SHA1
ce46bb1efd4f2f71821bb99a1af5cc00b283f10a

SHA256
2f3597b1e3572be05193a1d6216b04b0e37cb4461527d4e53f8e5ead73623f23

SHA512
1c9f52f2c8482f2b5e58f031f8efed2f681be3c27136bd9135bb58831ceb72ff273a3a81f105b559731fbb9dac2a0f4fd7f85b1acc6bdb3a897609eba773a483

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1b33977ebb884ba6b43981ecb1871e76

SHA1
e9e92ec2545e356b94f6a7adc2327bdcad275dc2

SHA256
b3587c42115869f8035fdbed215dc09fa9bfd66d6b150f57161a458441c1d869

SHA512
a4793342f35d36dffc3481bf9bac4da50ec80bbad94c4893d06c79b0347df52980751532b2d256cdb0de670d8f014086e1621a1dbf09af8c0a5f0abf8e3f761e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d4faf45b7e1fb891d508722f884beae1

SHA1
6a3f3e5b6f039200aa88f80035d8488a3fe66708

SHA256
6efdfb878db731523272afefed6e3be7b0d6a63daa063d79b2b1ead1342e97e2

SHA512
facf600b9440d6b5d972c6a7605a139163d83d76523904858070d354430103d3ba939078fb01b11749c09715ef15f8e8a97822ef14871d6109aaf71e09ba58bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f4afa0b3f624dd4b2274c4f63d81a94e

SHA1
78bcbbff62f31916355a13c859db7a40013c6f86

SHA256
059381e164783ff59f1227f4532c405c313f696135150c0cdbd3b110d3419a8d

SHA512
b8a1380d176e722bec9248da96df2df8e7627d66bbca91a9d6e984141151519ce3713164b79629dbf4abd091d25f0c9a5f55e58bdac6f0041bcaed98006aea9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d0f79363b7e25b3e27030c91c83ff83d

SHA1
e0cb4429700e10751888557048aa3f0b24088dde

SHA256
3ad11a3a733b44a6c963569d94f244994779da494dd3bce0022c0ef13ef6aa63

SHA512
cb26b4abe2d08feba9ce045f6606141a1114267326927a6f01ebc12b977052b54cee743e409ce2d48d93f0247236b709be919fa539cde7c14f758d12aee48a0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
cf5586fbacd57d018abea9d02727ec07

SHA1
da56c96846196a696c2943f641f5ffd04102db16

SHA256
7138b91a4f18eb40e6a468122740058a15308df36ba311bbeb2e020860e438ef

SHA512
f3ddf52d671a5a88efaeb1e418635fe25f4aa23732b1abbd8803e21a9e604791ae29e56fe465eb691ece9167429bb27b43d32a5f7c19ff24c0cfdf89f017b35f

Download Submit