33534c777dd588bbe8b67fa57edf9be23b927919966aa53f9bd86eff3d8940ca

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
31-05-2024 09:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

867857301a1df299a40bd6158e02da9e_JaffaCakes118.html
Size

85KB
MD5

867857301a1df299a40bd6158e02da9e
SHA1

45f4f312c66d6a8e4880f3e1a2a3d5792800e8d8
SHA256

33534c777dd588bbe8b67fa57edf9be23b927919966aa53f9bd86eff3d8940ca
SHA512

9f1300287a6cffc336ca1a84f4498c3d8e4ffba76f48ecff6ece19a48703187f5ceb04ebae184f58192d7de2f64c68d5cce304fdeaae9c72514c50ce6118829f
SSDEEP

1536:r/V03HH2lCa00mqvdVEwq+QFUvvmiChjhtFMEJ:r/ViHWAp0r1/QFHXjhtFMEJ

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe
4012	msedge.exe
4012	msedge.exe
3076	identity_helper.exe
3076	identity_helper.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe
4404	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe
4012	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4012 wrote to memory of 3032	4012	msedge.exe	84
PID 4012 wrote to memory of 3032	4012	msedge.exe	84
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 4136	4012	msedge.exe	85
PID 4012 wrote to memory of 2500	4012	msedge.exe	86
PID 4012 wrote to memory of 2500	4012	msedge.exe	86
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87
PID 4012 wrote to memory of 4864	4012	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\867857301a1df299a40bd6158e02da9e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8f40f46f8,0x7ff8f40f4708,0x7ff8f40f4718
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2388 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5044 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3336 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,811230007905226442,8425813266321897135,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5564 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4404

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5016

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4904

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
edc5623a636c412fbe4fa8db664622e3

SHA1
8e09480347d316fb650c9ccd29beb06df4310c90

SHA256
955151e6b1379dcbdee1ef30660f98c05bffb89f0d3b39281a5f17fe5e05ca77

SHA512
daeb9fdbd11b96fd60ff6191ae628ba83cf7c1f9d8c56d6d6cbceac41d420f9ddc4fde7363e958fd200bfa79cdf06ca07adad8cc9c85fa0311c398d484d46079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
2fc105b5885a297988496a171021c9fc

SHA1
ceeddb1bd6b134a5c9fee5372465631d5045d190

SHA256
c4186f7ccbdf86b5fbe7dc4967564fb670a4b0d0dbeca3a816515d113b9ce646

SHA512
3eb45fe2af01320b9c5d38c3f9b1e0d42e45bfc6846e6b6bd5c27f89736bf5675c8464097d8494d00e30e76cafb9064543acc6d56878e0899b345b0b350ec076

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0fb998442cd5dbe564deab1c40bcf61e

SHA1
d92237123b4a37e0650247a5ab9208ec9e440998

SHA256
876518b59ce308ba4e2c7d5475c56540f03398fe2079311b2a265c8bf3013277

SHA512
956b9c486aab3e7096b8cde7390e5ed0044bfd646be8b90ff4098ed4b869cf8802c13099e4f81b0f70de3a5d3181670ed0814a981ffaa98d368a540aeb923867

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5e2d878e47072a02786947d63576b647

SHA1
a66618ce1b87596107e7a7600b02db3823c676b9

SHA256
aa11d481f58481e729682ef7b93dec7a70fffe3f6c1eb564c3e60f064c3dc69b

SHA512
3ff8812e88849d039e711fb4c5fa0acd76340342b38957880427138a786a0fd034773b9e1c4b755f61c732f03519ff1aefd527047c0f99baa51ecb4cbbd5db19

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ebd5919a946403b753cb5b955e0e39d7

SHA1
11acc6468d1dce2a38728cf5652dc15205578f71

SHA256
820afa98ea36c1292c51d29eb86e06094aa584166eca2148ddbcbc3c556343f0

SHA512
5cc538c2b120fb79de561260df9d4bbb34242fb819cf1065a0e64e3fa8d27d883bec92ec11129f5a942cca8036d7f4a78f3216683c81651ae1cd8db7c2bf71c7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a9d08e39-7354-40d3-b70e-e970cecfeb59.tmp

Filesize
7KB

MD5
e040e3d6e374d2f5c6cf9d92436836eb

SHA1
94e6fec181269a3a4ca5234c777820c3ba2b5fa1

SHA256
01085f98a2b40a393da89b2d1386fbe9266ecbf46a8c30800e585fc5d6b4e3fb

SHA512
ef9afcf6c7845ce0fead55874c16961797b93dc7e334b16904933aec13a239dc139ad38dad831df59fbdce9d8abe3d32b86fffa89b39518d24e26a8150aadf20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\df21771e-ebe2-4974-80c3-c1da008f8198.tmp

Filesize
6KB

MD5
3c809959543b3c6659bfc8dd8ea81d0c

SHA1
659b6ba4d457e1332494d8c1d4f927c41cbfc0de

SHA256
0a5dcf8ea72e75be0762e9fb954bc6a45607b4b304512473c8e79588aa4a9234

SHA512
38578c4d82df523f4850a4400d89c5dd04141ac878ac90a29e139633757b05871008cdfcfb0c155cffff0e0a80e772149c194134af39b85c054cf015cd7bfe2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
514d8b51c5440ff63adcd99d7dda3660

SHA1
4ffd19a109542825a9a25c2ed80228997a626450

SHA256
afaad2ef46fbc703aef95257f49cc9c3f62fbcb6a3b4dcdb97f1dc7d1786c16c

SHA512
b7638ccd46a8d317159972d4df70d82c1eab9e16ca69cb6c6f36f5e0922e3885f99a4ce28017df40d039e71b22656588de5e817b4042c16f093b2d783fd24eab

Download Submit