24acfce804a73510ccb54a08c97108df06e3601766bf77517f151a649c1724b2

Analysis

max time kernel
141s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
12/05/2024, 15:47

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3ae13f34a40db1ddbe01e0e72ad61849_JaffaCakes118.html
Size

45KB
MD5

3ae13f34a40db1ddbe01e0e72ad61849
SHA1

96890545745c1aa455ea113bb1ead16dab05275a
SHA256

24acfce804a73510ccb54a08c97108df06e3601766bf77517f151a649c1724b2
SHA512

7c08e0aa36dfb519d792c2dea9d3bb37d083f71546af3bede4ff687a1effeab25b7db5dc4f93c24ba068e429e583769410f085e24e9e383680005b0e59fb0488
SSDEEP

768:Bql4Hse0SKlpfcvfbkwBfWE9toVvUyXPyrwvXJN8FORtzPp16oWeNoQmoG0jqT5S:0WHse0SsfcvfbkwBfWE9toVvUyXPyrwF

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4856	msedge.exe
4856	msedge.exe
2440	msedge.exe
2440	msedge.exe
1560	identity_helper.exe
1560	identity_helper.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe
1100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe
2440	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2440 wrote to memory of 4504	2440	msedge.exe	82
PID 2440 wrote to memory of 4504	2440	msedge.exe	82
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 1532	2440	msedge.exe	83
PID 2440 wrote to memory of 4856	2440	msedge.exe	84
PID 2440 wrote to memory of 4856	2440	msedge.exe	84
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85
PID 2440 wrote to memory of 3772	2440	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3ae13f34a40db1ddbe01e0e72ad61849_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb576846f8,0x7ffb57684708,0x7ffb57684718
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2680 /prefetch:8
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5496 /prefetch:1
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5920 /prefetch:1
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6384 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,6062045916917038383,12191125460643465142,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3540

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4f7152bc5a1a715ef481e37d1c791959

SHA1
c8a1ed674c62ae4f45519f90a8cc5a81eff3a6d7

SHA256
704dd4f98d8ca34ec421f23ba1891b178c23c14b3301e4655efc5c02d356c2bc

SHA512
2e6b02ca35d76a655a17a5f3e9dbd8d7517c7dae24f0095c7350eb9e7bdf9e1256a7009aa8878f96c89d1ea4fe5323a41f72b8c551806dda62880d7ff231ff5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ea98e583ad99df195d29aa066204ab56

SHA1
f89398664af0179641aa0138b337097b617cb2db

SHA256
a7abb51435909fa2d75c6f2ff5c69a93d4a0ab276ed579e7d8733b2a63ffbee6

SHA512
e109be3466e653e5d310b3e402e1626298b09205d223722a82344dd78504f3c33e1e24e8402a02f38cd2c9c50d96a303ce4846bea5a583423937ab018cd5782f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000c

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
97f4c11061d5f8a1472b240de405b348

SHA1
9d73f6912d5deadf981bc6d08add69c27db5874a

SHA256
a330ed2fd2b40c083070dc4091eaf80eb98495d03a23807bd4b18f794639cbd2

SHA512
c8e47b394dac91f3b8e3175500570abeb02f626652806fff75fb484c0393404636401399a0d66d627bbb4d0003a30bb6d915d2b28b79faab913aa7508c87d9d3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
b0bb467ca6fdd7efb06735f5845f0ac5

SHA1
31881071422c1ef744608812a55b409d527d6a40

SHA256
002c4091ba4d09836ff9cdccddfcff4d0e09a4527e1155ebe93f0b4fde31829c

SHA512
255d37daac96b363c6e7ee10d67c757cef2cec97b76a521b3a45cde8245e96a8252b52032dd1d3237282b00f3f1e5f5bb8a36f7dfca20a88aaacd62965e324de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c6a788707a63a60b227d552b9b88203d

SHA1
6b38fb706685c549b3d332eb78c3f441cc1f49c9

SHA256
511c644a586f382b644abe892468d96a8bfbcfdd5ed82060c5108da6cb17e225

SHA512
a994d1e4a4433888e6cf8cde253690219e9b379857530c2e3b581e870f6af907a079aced69ec4dc49dc453503929aace7cd1946357bfc4c94f806a2dd9ea8755

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
ca3a66c1b2fe68a9100562e9452def7a

SHA1
634624b00f509c8d03d1528e007c4f9227ad4d89

SHA256
604167ad1b9249dbe401bb513526b7f919ea854761415896f64e104057495833

SHA512
0eb3f75407d72c829c076e5dd00cea8b02aac0740556403fc4b69b6abdb12bea0b8f39825aef134dc7767833828fb0b73df4261a2b1b0222a3d52994adb3e8bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8664972c37877c806e17e62c25a8ab57

SHA1
329114e50e3ed9a5aa0603888781e7948927b552

SHA256
02b6b88f65a39f90ea8e8d5d6f95eb8ec6a2cffdaf852055263f119decb7d5bf

SHA512
0e80143f83db4142133889f975387e7debfdff3b970729dec919f23337c8baeb4fcc7eff7aaf8ce1e963cf4eaf944c2a3870fe01b38359ff358010188df9e249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
d837ba5c8826691585fde0cbfe1f1eba

SHA1
87f0517d84783fc9b9d9be266c9419c3b268b62a

SHA256
c7ed8299ecf709997c48964bdb75b26ac5d8c1cdb569065ef26d03c8ba1d2cbc

SHA512
937f2d7a2071f67766322293676edc8ba7728e75e374c5ea6cd6e62ce32a70e6a957e51ced2a2b8f11c31f1bfa9f1e528d329b0fe1ec874877224c365fcae870

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
38de205df6c0b04128e09c8038d3b71b

SHA1
d4b6097d37196978b648acf7dc93bad1253cded6

SHA256
1ae1bf5a8eeb7f54048322fe12e61b1fee64a6bdcb372aea1b4ea1b808991a0e

SHA512
33e1f2b5ac94b80cd6e019e21fc486dca903801903d3c308968bd747094d7fb04d3ba137f24078fb8f2fd6baae34bb1487684b3b6db580567a163e93c3e46d40

Download Submit