d6bd6edc750db24164744e1c1ea015109490d219095150840813608fff69df96

Analysis

max time kernel
137s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 02:49

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

741b0d74a6b2ed7ec4b23b5a1aeb00be_JaffaCakes118.html
Size

103KB
MD5

741b0d74a6b2ed7ec4b23b5a1aeb00be
SHA1

61f6ccff9a2d200dcae1c9b88a8ab40fb64a5610
SHA256

d6bd6edc750db24164744e1c1ea015109490d219095150840813608fff69df96
SHA512

b00b0ce2617229813e4de457ef360d23fbca00a805d5ef479fd3136fcb79ce97c2f45c87db75623d74688e161288c99f9a348062ac14b37331e92f563b516406
SSDEEP

3072:NNFQCBxRe8wNP7GT4aZYhBfrlsoErAKrFB:08wNzGj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2004	msedge.exe
2004	msedge.exe
1784	msedge.exe
1784	msedge.exe
980	identity_helper.exe
980	identity_helper.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe
2180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe
1784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1784 wrote to memory of 5108	1784	msedge.exe	83
PID 1784 wrote to memory of 5108	1784	msedge.exe	83
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2428	1784	msedge.exe	84
PID 1784 wrote to memory of 2004	1784	msedge.exe	85
PID 1784 wrote to memory of 2004	1784	msedge.exe	85
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86
PID 1784 wrote to memory of 2360	1784	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\741b0d74a6b2ed7ec4b23b5a1aeb00be_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xb4,0x108,0x7ffcc77946f8,0x7ffcc7794708,0x7ffcc7794718
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2240 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3180 /prefetch:1
  2⤵
  PID:2620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5376 /prefetch:1
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7136 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7120 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:4712
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4536 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2160,10810237122518204519,8631864248839243211,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6812 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4932

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4228

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c9c4c494f8fba32d95ba2125f00586a3

SHA1
8a600205528aef7953144f1cf6f7a5115e3611de

SHA256
a0ca609205813c307df9122c0c5b0967c5472755700f615b0033129cf7d6b35b

SHA512
9d30cea6cfc259e97b0305f8b5cd19774044fb78feedfcef2014b2947f2e6a101273bc4ad30db9cc1724e62eb441266d7df376e28ac58693f128b9cce2c7d20d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dc6fc5e708279a3310fe55d9c44743d

SHA1
a42e8bdf9d1c25ef3e223d59f6b1d16b095f46d2

SHA256
a1c5f48659d4b3af960971b3a0f433a95fee5bfafe5680a34110c68b342377d8

SHA512
5874b2310187f242b852fa6dcded244cc860abb2be4f6f5a6a1db8322e12e1fef8f825edc0aae75adbb7284a2cd64730650d0643b1e2bb7ead9350e50e1d8c13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
da0776fcba5e6fba4ec39c2475387181

SHA1
a0836a752b19812cf02d1ea4cb209963e39c0f5c

SHA256
48d29cbb1cbcb79f7d63ea8c240220f5ac7d8b36b546f00a99dfcccc250d7f3c

SHA512
74f9e51b638f77cc5fb4dadca3c90e4033bfef0c9978d7fc4fd54c20b2501bfeefb570dca5a25f40e2ab9eab80eacb4f18082e38f4318f67170e026fd4a72dcf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
5161fb726388f967fd36a586f00f3461

SHA1
690a0135f104fa45c808e26269a37c95cc08bcab

SHA256
930616f3cfc6c25e7c042aff3d9de4a8b46ae84d713345a16485424e781f5334

SHA512
915b4e8fe7a81a673880a16ad484fe48f96ee881190c885b9f580a7386f6b482e0451d04888863236ed58f7bbc5f78d4eb9b42e24e0c27910f16dd48ea83c4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
c6e303570c3a1f0abc7e8ed4ed2ad09f

SHA1
188e8cfe9cfc3c14b8c30f36b2750a410e7c53c2

SHA256
0b80f5ea2b378137eeab474efe18140875720d65fb4f902ca624c91edb4b8dc3

SHA512
61e0eff0691201d7d829e291f2423f4530d206d268f568e0c440c98adf7bb26fb04d524203aa2dbc0d705b3f1b7db6272accc2156c48bdcc1e4237bbbd66c0e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f5c7dc09d0f4ed64a72244e8a162c4ee

SHA1
124201020f63652c95d5d28eca34dbcabb7514f8

SHA256
207ad653a81fd349616f0af9516cf8fccda5ecc5ddc1b1bc825b8f33c776c8c2

SHA512
8db26b011b247ab794cadaf8367392a827e1bd98376270eb82173d280c967015a1eddd6ef99574da281621228d19708f7d49f149b5360a09a0953d9ce98e6ff2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
11aa82c4a1492d2e118cbc48410999f8

SHA1
71dda11d8cc300641fc316d3d441e9e24aaa545d

SHA256
f179e5ad0b1f73a014d664a993b016761dc47fb88cbcaaa80649c4681f21567d

SHA512
0a85df7379e1f6a3f9fbaff0aa8b02c3deec16534946e5e75325ba61bdfb0d9179060949f360dedc05bfb6f1549f1b7ea2b9d585981815e79346491bfef512af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
630299c5cc939e9fe984348b99480120

SHA1
fa51bf083e0fe950d690e67d5fcbef60404ea44e

SHA256
403b7029c467dd11109845e859cec62b55c5a869a6e6fa35148e940181db9da0

SHA512
76cd8f2d6be741a65b62b92e72b1c80bbf1e98b2ebe3a7ae116bd0e07e0e47f1bb6b4eee1366671635418ca844d709b6e2d8f50a90095e6b5dc620c9cfc37075

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
28a1d9cfa545ec8f5f33cd73e44ab40f

SHA1
7d60f5abb06ba26ba5335449144475bdbcf921dc

SHA256
2a24bb71eb14604f90ae29b4f3d0b19ed67e10130c25b372cc62249a6d39bc51

SHA512
8848506d67d31fee0736071ffa69fd8f25f1a2a20fa830555117ed9710368629526cfdf51a2ff02782cc43765bd6fd39e0671664ed8c7a261cd3d0e98e161afe

Download Submit