11d2c11f7442895c0f21d55193c19a07d6b63200b6b4611fd9607077dbfcbc6b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a28661f3133a5d1435e42f7c954d57d1_JaffaCakes118.html
Size

49KB
MD5

a28661f3133a5d1435e42f7c954d57d1
SHA1

40e3d63cf2511ec23b8a1c724dcb8100819998c2
SHA256

11d2c11f7442895c0f21d55193c19a07d6b63200b6b4611fd9607077dbfcbc6b
SHA512

a4bf6f75f48db2decc4d3394844845310c9d65df07a19ca402702a1fe84c79df24f16c576694b61f62d6ac25673b875ec35404bbd8bc5d677ccd11e36b78c8e5
SSDEEP

768:LayHHvPWloZgB7OB1HOzK43SW/OiCoeDWjg0KMtEVGj:L3HH2lCglOuzK4miCmjPKMtEs

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
5388	msedge.exe
5388	msedge.exe
1076	msedge.exe
1076	msedge.exe
1888	identity_helper.exe
1888	identity_helper.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe
5676	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe
1076	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1076 wrote to memory of 464	1076	msedge.exe	80
PID 1076 wrote to memory of 464	1076	msedge.exe	80
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5668	1076	msedge.exe	81
PID 1076 wrote to memory of 5388	1076	msedge.exe	82
PID 1076 wrote to memory of 5388	1076	msedge.exe	82
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83
PID 1076 wrote to memory of 1736	1076	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a28661f3133a5d1435e42f7c954d57d1_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc862f46f8,0x7ffc862f4708,0x7ffc862f4718
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2140 /prefetch:2
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4936 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:5788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5524 /prefetch:1
  2⤵
  PID:1884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:4068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,1449688322584815450,1420320137690209914,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4800 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5676

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2868

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2124

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
db9081c34e133c32d02f593df88f047a

SHA1
a0da007c14fd0591091924edc44bee90456700c6

SHA256
c9cd202ebb55fe8dd3e5563948bab458e947d7ba33bc0f38c6b37ce5d0bd7c3e

SHA512
12f9809958b024571891fae646208a76f3823ae333716a5cec303e15c38281db042b7acf95bc6523b6328ac9c8644794d39a0e03d9db196f156a6ee1fb4f2744

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
3a09f853479af373691d131247040276

SHA1
1b6f098e04da87e9cf2d3284943ec2144f36ac04

SHA256
a358de2c0eba30c70a56022c44a3775aa99ffa819cd7f42f7c45ac358b5e739f

SHA512
341cf0f363621ee02525cd398ae0d462319c6a80e05fd25d9aca44234c42a3071b51991d4cf102ac9d89561a1567cbe76dfeaad786a304bec33821ca77080016

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
45b5237ab402fb563aeb6b72b312cea7

SHA1
b4cd6092e9916eaa9bca398b54f62a39fcdd0bc6

SHA256
ad4aaf616c49faad46c023a0bde0c5c3e51fff767aa05a23ae0b784bec4536e6

SHA512
47d745b5b063c7f6d072be0f72c2e299eebe2728425c174d6dc89e52e349d9e36e6f1aa533aa3ff186927f30e9bfba12ae940fd93e4dcb74d53e8e8fdaefac43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
8ca21b6971b0eec988d66cfe18de2435

SHA1
3d0930b27cfa2d1ab8c02485492b9765838e70c8

SHA256
0a49a00d244467c8300455c0d4a475bb777392038d455640597cab1ce120ad27

SHA512
f3a11a703cf5ac02378dccef0b792d0cb1befbf8c6ba75833d520e2371311f0bf5cb38d1cc4dc5d994dbd080563e7562420043ec48bb96ae3646de4385e6ea70

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
10844c71f7dba55c72ea973f6983297b

SHA1
280262b98c475dc6c1bb345f3a767f96a337633c

SHA256
4e40409804b02073254bbf615b25ee9706c57643fe7928753f9dfec9131f2685

SHA512
612136d40e052c0a96df3fc724b927ba66f486b5e61c96ae35e98cb70a2b53d1c0af6d7a96411e8c2721fe323edd2acf05eb39796e620f03726e1eddc7435e91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9f0207ddb003334e8f732be4dfacf6fd

SHA1
b0c42ee27e4217d514d2b3c67e9c89f313f8bf15

SHA256
2a549de1892e553741d92c8f07e6d31d5b85aa9055eac8813332b41938679eb9

SHA512
dddb7d444afda7ac01246a3d2f5b9aebc3eb3c8a2071a03ca1ea818f7be2c6a0227761855728853bc497d623b4bde3d866668c5c3f1e5c1323d594ef4601671f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
3b8b17f854cd4d581c95ca922feb42de

SHA1
f84ada4a54496c82c5cfde6c711ab8ea57abf60b

SHA256
e747d51b22e2bd45fec1c1797d99b3142997ace927d0dc550e6f3ba11ced3b93

SHA512
cdfc458f2ef464fd2ba75404d7902f116847374c15f849e5737e918b18eb874e1f569b3dd3759b06ac988c819b86e96383e093dde1c4b47c10f158167777a980

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cf8eb46292f0d27c0b02749ba4552a8e

SHA1
e1c7e05e5541e52d581614ba9ad07f9df43cd372

SHA256
e6f620966e8c3bc4be102b3bc3a8b463d808c29ea2c6d241d3b3a74679e8c41c

SHA512
604307dec41e4053f6917974244aba6ee7d801f27a1e0b61460e455cf5c2080656b82bbf333a2d799d01b493515b508f131e01afb1696a045ee4815a58226b1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e3931595f6b9031b024b57ffcd4a48f0

SHA1
1136edbd80e08d79310404dc1a5585e7af68f331

SHA256
5b160b6ae2602457fe2370392f2bb0009c78fc6233ae4d10c41ab698eb2a50c2

SHA512
651700f0f9d03dcadc22fbeff7efbe35d3ff6c5d2e00d49fefab37b501afd9b32e1e87621a9fa9c04642e2894adbe1004ee838551f1dd9e7d6a474bacedd4ded

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\bd6136a8-ee58-4f8b-abef-c1f51bda364b.tmp

Filesize
11KB

MD5
5effacfab4de618259f036feea3de95c

SHA1
a3f10dca8efee154fc09a43cf1b4b2ba3c1f218a

SHA256
30bb36eff8ef9b4264a1cfd92b5e810e4e7c21f08408f36b40664fdfb09f6b09

SHA512
df931d37eefa34127b811bd70b150fc4bf861c1f2c19f0cb0827438f3e2c2864b5d721403867c1f09cc0698356fa1f89cb7eeb1f4017c74b898058303cb4e44f

Download Submit