3f07f38092ee003adafb810bc398eb4abf8844fa4ce140ed5199fea2917723db

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
30/05/2024, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

84bac8a8aa91962a238594852c60e63b_JaffaCakes118.html
Size

70KB
MD5

84bac8a8aa91962a238594852c60e63b
SHA1

c6042f00e5d562b8d14796dbdb54e4edefce6aed
SHA256

3f07f38092ee003adafb810bc398eb4abf8844fa4ce140ed5199fea2917723db
SHA512

a7ab3e473488cb750bb47f4c9b692b18e1ca941900a6f41a200746a52abc044bf775410ab31f53e5430c5415cdb8028df85999b9df0edcb7d9337fedbbde68d5
SSDEEP

768:pV/s1sLsC33HnBNz3auFelIRNJ+6RTPZ90lyTc/hiQolV42Sgf8:pqmA65elILk6TPRQolVI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4484	msedge.exe
4484	msedge.exe
232	msedge.exe
232	msedge.exe
1600	identity_helper.exe
1600	identity_helper.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe
4868	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 2100	232	msedge.exe	82
PID 232 wrote to memory of 2100	232	msedge.exe	82
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 3832	232	msedge.exe	83
PID 232 wrote to memory of 4484	232	msedge.exe	84
PID 232 wrote to memory of 4484	232	msedge.exe	84
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85
PID 232 wrote to memory of 3068	232	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84bac8a8aa91962a238594852c60e63b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe542a46f8,0x7ffe542a4708,0x7ffe542a4718
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:3056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3860 /prefetch:1
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,15572311473300443021,905255317566007036,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4668 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56641592f6e69f5f5fb06f2319384490

SHA1
6a86be42e2c6d26b7830ad9f4e2627995fd91069

SHA256
02d4984e590e947265474d592e64edde840fdca7eb881eebde3e220a1d883455

SHA512
c75e689b2bbbe07ebf72baf75c56f19c39f45d5593cf47535eb722f95002b3ee418027047c0ee8d63800f499038db5e2c24aff9705d830c7b6eaa290d9adc868

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
612a6c4247ef652299b376221c984213

SHA1
d306f3b16bde39708aa862aee372345feb559750

SHA256
9d8e24c91cff338e56b518a533cb2e49a2803356bbf6e04892fb168a7ce2844a

SHA512
34a14d63abb1e3fe0f9927a94393043d458fe0624843e108d290266f554018e6379cba924cb5388735abdd6c5f1e2e318478a673f3f9b762815a758866d10973

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
63c090139a4a6c99ff2e0026cb44e34a

SHA1
22b4a4e1eb92e8fe41e87756e91b825f8046b1fb

SHA256
0a1503101cc550fc34cfd6139101e941e3d5223f70c421b8fa4ea90ffeae79c0

SHA512
3cb3f5dd264a4fe2d3f92bfd5513d1f565250afd4e220c5e83813cb89e3d940493309af5fbfad447eedde315f685763fc2efd58bcf36468a7defbd2d087f2833

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
030689f391ee914d0861512ee87616fa

SHA1
a4cf086f1fb14da45aeb81a876cc1899b4c587b1

SHA256
39cfd651e36e889282b6c7c5f214b11c97fd5a59c89df1b3b7209335860073e0

SHA512
eb3d6e5269277ad6d8a4afefbfea885e89ab96b0b9e40799bbf32b9e482ac9129498fbd91bb00ec284ea7b22d7282067157aea199aa7b609c5b4512c1153e4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
68f499757f8bfdbef84d54022500b471

SHA1
d658813187aab580fabb39a3a021739d89c0038e

SHA256
9e87f44ff4bb63d19792fbf4ca6a36d62262afe558bd9ce96ba543ec1959c2e0

SHA512
bf28ff8f85add899ab38f88d551555ee4da1cb48136188472666dfe31249be31fb1e0091107cfd598cf47a95bed10a2892a253bf4704eca33e3a62452b380b65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
77f511889d202724075592cd8cfc5972

SHA1
7b25895493481601ad5d2fa8fc6999a8ff9c7b78

SHA256
9844b20cf0b4035e5c22699d7f1b19068d7a1c82c2a164a9bb707bb13338453b

SHA512
2ddaa251646bd382ccb5027842483a097fe0485321cbc08aaab7ad92a9d5afcf5107346f607f99eb202dbc84cbd868b7a4dda34dc033e1b8750c3c7cce9ead10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
9403aaa02cbfe81a943b18b4f8e30b7e

SHA1
7a9a9c78cfc28b68e016e744d7dd5430158f832f

SHA256
48cbcf9cfd65f020721a8a088cc84ce9b1dae22bdcb7c935ffa07444671c57a1

SHA512
92591acea227f09e892cf7fc401c98b4edfd25464dc70442d8fba040eb83f6df48609658b7bf69931df236b14d9560ee1aa0ce98838f4e8459ea1ec78c314916

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7514382dd8f3bcb1ef4b67249b6b9b3f

SHA1
a1d004a740df67d887b31af4bbbca254eb0c0051

SHA256
456ed38210a669fe23f65600b355a9bc35c621a9c83dc131096e20d588275141

SHA512
d5d383538c5d7ebdcd5ccb985e7d8638c8f1ab70d266ef0c0f5734c4b0d029d10f0ca5dfaa513fb8e466852904ad798387919e6af794bfd767cd99fc76dce2e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
e069125c35cb3478803322b2a1eb837a

SHA1
c83de3258d99b5e8570b099c45c2610d66bdb15c

SHA256
1241df9168126276ef6e1bb587ae0084a8b9c40e10001c351020da4af7591b45

SHA512
fd3a822e5dc54be22e4791c48546b6fe265118f91d97872b58591c7ecd6c5e54808dab595167c17146e3c1eb9318e01e78d0fd26b0a058dad44ca308d442b062

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
8e846477c5ad3c69728f68ae26d84bb7

SHA1
2f56088374d92e31bc7848119515dc0d0f609e85

SHA256
81cef721fe92606fd13dc88c349c6eb2f6fd3a9c3e7d562ff07e920f03e7e5de

SHA512
acb3bd259b7dca0b9d00c8268a002f9aaf681e60f8876b64425fc7bda7fea83f864867c555da89c63bf188585c1c5b28f632226680c0ec4fc927cbecc7689d44

Download Submit