e043c05b32672731ca32ee42993e20695bd06843e2df5582da5c384d1f412d60

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
21-05-2024 03:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

61e84c53e9162557b6b4f671017de921_JaffaCakes118.html
Size

164KB
MD5

61e84c53e9162557b6b4f671017de921
SHA1

09d0c9901ce6dcd84a3d0a462201e987ee6be1ab
SHA256

e043c05b32672731ca32ee42993e20695bd06843e2df5582da5c384d1f412d60
SHA512

ca407ef0a08266ca91dd51e7a5226c6fe373cb92b84f8b79724f3674d33b6f9e46d6b9d6f918873059c0f749d53ee03a039c65591e97176fd84cf3be3cfc6347
SSDEEP

3072:twbmcAHRaZqkH2R/1xDomfGFjLt2jdpCIQKtWlkeNVMs8sMyKMppcnz:twi025omfGFSpCKyhKH

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4008	msedge.exe
4008	msedge.exe
2148	identity_helper.exe
2148	identity_helper.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe
3644	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe
4008	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4008 wrote to memory of 1464	4008	msedge.exe	82
PID 4008 wrote to memory of 1464	4008	msedge.exe	82
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 3272	4008	msedge.exe	83
PID 4008 wrote to memory of 4388	4008	msedge.exe	84
PID 4008 wrote to memory of 4388	4008	msedge.exe	84
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85
PID 4008 wrote to memory of 2620	4008	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\61e84c53e9162557b6b4f671017de921_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe401546f8,0x7ffe40154708,0x7ffe40154718
  2⤵
  PID:1464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2936 /prefetch:8
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5168 /prefetch:1
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5356 /prefetch:1
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5364 /prefetch:1
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:3952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,6060412291151329937,2036705581910463303,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1776 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4612

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
33a719eb063d2caef727cc0937c31dd5

SHA1
89b083aa52d1064b963d43fb2affc0fd2f98e9bf

SHA256
3dd8e8e819ccf4d4a1c6e2215690c15e9d71972c878665eebe008c6dbda2f4ec

SHA512
52fe955c9d515be9ac93cb6f5a25c49787b2c715235d8198f16629174bf19107f05558c62dc1c7aa0a356d02a464ae47989fe415718bf71bc637b49231021e51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
a699ced4e8329e2cec0c24d3cff3d7c1

SHA1
a897af277ce4ebae19cc5a9824fdbe2c7015876f

SHA256
d3016da3b0eab5ef5137a9d982d682edda75e9be2e75cd8b81137b1f73bf9fb3

SHA512
818a59e7f2bd005c539bf4d78ca45e7827822939c3d2eb9e9d54c3bbcc3057bdc61b5dfdcd96a6d0df1aff096262c02daff98827c7724a7a659fc28664d5cfc3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
806f8106b34063471dab57427408d1c6

SHA1
fe661d4a14767bda014ec31ff8864c1a19068a9d

SHA256
704951f1eddc890f3a0e824d2547f989b75b5a051360181dbd208a0dfb27097f

SHA512
9c87d884c5263d73f2fcd19085337500724b841754f90a6dfd17d892513fe469cb9e1eb022af074bfa5e70b211322bba6ea2ecd2ec3cb7966e2090cccd6f0271

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
679a470737082cc3cbc733cff36df50e

SHA1
850fc925ed0d9648e3144ca178ba70687117af11

SHA256
28aa67c4ca1a29263feb55bd69493c40f98b6f2e3f2c6642be818fad488893f7

SHA512
a814249667c4d2aec1a5fd7e07a58764a06d6f1814a703387ca4e5b71ded5a4fd7d3801ad7cf64329551e0929bc758f28511f2b4321f466103d2fe8a401cf3e9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
87e2b131171af379aca2f0265e0c77b7

SHA1
6a3d7f5974ac3e109f4be275f5bd11cb0b8d0279

SHA256
7bcdfc8d10ab40b6223a264dbbc59edc4b03c0f0bc80025b5780ffe9f115e220

SHA512
3e6010a2a6278a571e91da9f9e6b61496ed15312b9007ecb5a49b406cf3cc25aba46bf0b3e82c67d828eef2fcb9f5335ca7ba57b867c1dfb403fac887bca7a22

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
787ef34174c469443cb7333f84f37653

SHA1
a087308f7597cfdb582c3dbd6bc096ad7264c72e

SHA256
7e6a496d60e820e35ffc2d1afbd83426aa38a6ab2d80404f02860402a646f7cc

SHA512
138476aa938d95d204e32b5fa584589ce9222eacfcf9e56c91d2c22056aa9e1ceafea18673d35c27d9bab3e51139b2719814f49c83e7d39b62c2d7cc48cdd42e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
10244088809fbc0950416a4597be0be4

SHA1
4897e30f63927d4757f6a1e4eaedcd23981e9249

SHA256
e52a28b4cd0bca7c99c68aaf647165b21c20de7b42ceedfcfffce5930091a9f5

SHA512
de9f89c15dffbb256db1981ed5db9ace53fe5020d915fb88480e0e5a0c9b51104b79634a74bde4c086a0447afc1e3f1e0099991007d2d0f6dc4e0620611dab90

Download Submit