f42b33b6c3476a95bdbb5e8e53d1c6d945dd60194b956599b1d6e63ed4124835

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
12/06/2024, 21:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a286d780314029c2c094f648204dfd57_JaffaCakes118.html
Size

49KB
MD5

a286d780314029c2c094f648204dfd57
SHA1

c64be83aea0dae1369fb686a6afdd2b524e86d0f
SHA256

f42b33b6c3476a95bdbb5e8e53d1c6d945dd60194b956599b1d6e63ed4124835
SHA512

47468e31f165572922987bbc41a9998d3cd28ffa8145dc9af49b51204427da06229b0457bc1c58d1ee412006c2982b40f8c99401128014d0673f3d62c89dd276
SSDEEP

768:3gOriWNcaSyLRIaKEgZMOJigJNks2mXerHdh29qFk:YylIanOJieyvHdK

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
660	msedge.exe
660	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
1148	identity_helper.exe
1148	identity_helper.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe
4920	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe
2604	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2604 wrote to memory of 4744	2604	msedge.exe	86
PID 2604 wrote to memory of 4744	2604	msedge.exe	86
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 1068	2604	msedge.exe	87
PID 2604 wrote to memory of 660	2604	msedge.exe	88
PID 2604 wrote to memory of 660	2604	msedge.exe	88
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89
PID 2604 wrote to memory of 4808	2604	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a286d780314029c2c094f648204dfd57_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff82b7446f8,0x7ff82b744708,0x7ff82b744718
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2244 /prefetch:2
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2852 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4644 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2304 /prefetch:1
  2⤵
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=212 /prefetch:1
  2⤵
  PID:1192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,18431958594992192939,15174536162844995366,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1192

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c5abc082d9d9307e797b7e89a2f755f4

SHA1
54c442690a8727f1d3453b6452198d3ec4ec13df

SHA256
a055d69c6aba59e97e632d118b7960a5fdfbe35cfdfaa0de14f194fc6f874716

SHA512
ad765cddbf89472988de5356db5e0ee254ca3475491c6034fba1897c373702ab7cfa4bd21662ab862eebb48a757c3eb86b1f8ed58629751f71863822a59cd26c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b4a74bc775caf3de7fc9cde3c30ce482

SHA1
c6ed3161390e5493f71182a6cb98d51c9063775d

SHA256
dfad4e020a946f85523604816a0a9781091ee4669c870db2cabab027f8b6f280

SHA512
55578e254444a645f455ea38480c9e02599ebf9522c32aca50ff37aad33976db30e663d35ebe31ff0ecafb4007362261716f756b3a0d67ac3937ca62ff10e25f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
9b5a6e36a5bee63333a085df167b50e3

SHA1
0dffe121d6e05f9705889472be732804484d319a

SHA256
5c5ac03f6863935fa05c69f27f7a01deeb5f47be60caf0e6a9eefd1217ec1626

SHA512
9da8080de1b863c4841d9c9bf3d8347b5f1f15c0369454e1cd3dc581b0bdd4654d865b82961a3535418d3a2a9dacdd0e345dc81367c80c7dd367c4e3d8dce170

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
8b8d71d73d85aafa4e9bae513d6b5b41

SHA1
808f53cac0f6b3d8bfa8ce6b60604c053d5b37bd

SHA256
87d2e600ade2b4d9b7c11801834ba0946f18d8cf987e8b540678834480bd4b6e

SHA512
bf4fa8a6664336ced8fd4efed1f4471866e3e90062a1fa874453b62669423cb516953b734dd0b0d1de7eb40a41ecd261ba561c8303f74aab685c28e0db7d2c20

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
1182e4388132b9e87c130826ef30be65

SHA1
147a26e1de3a536b9b7dd72930ecd8e46cba6533

SHA256
fed33c03b730042151e9207407ae8a2c9541fd160e8194f730678d17975d7b51

SHA512
74cc68af5c715c45de1845ee857a014e9e11d19711e6b65d6a4da05d6f507a4c2358a4f92f01780fb454f2402b4c974ea97d0cb87778a601f469fe5c5e4d4a9b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
bea2c08aed25301abe297243ecadf8d4

SHA1
a1a0ef19542c6c6cc675e51e79bd1625ace005e2

SHA256
cb2100bd2363e1af81ec3dcbebf4bbcf592bd4e10b03726efd8d2d7acacca964

SHA512
106a566f96e247766200dbacc9157ba6bad65b0a13a43feb687236dcb94ddfe6eeb46900e0a22a7bb01d690f28392d471cb3cd497067890fc1a01bb80b02d234

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
17da637815271ee67a6f75bc808c0efa

SHA1
a4f8f663949d58237611c00dd699ed5f9e362ffd

SHA256
b3fc80988352cbcd92ca83a1766c2e15be3fcd001a2378cdf03e3a69d89b31a9

SHA512
3890b95539626614e9b8fd66440257c19d5946ea5a89b6d7293ceb9590eb509ba174e63ed618d6cd8d84dee9432b1e3588892f67de12a44d5cec9f725f481325

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a62521a4a54b2c3feee48e1a6c3a4925

SHA1
202a978504d76b601615b16194e498f5b984c2f4

SHA256
0c575c57ff305c182f832ee19713c5574eff10d67df43eae18412ba28be993df

SHA512
6c352e5eb74a2ff8a49a1903f0cf4bc340cc766b2a46de34d7ff0266f8032730ac0b4be3a8cbc38a4b6f1b7d15ed7b0bc192c95d120d9d363e3d638b2473a004

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
4221f5faaf8d0e0cecc2c427801a645d

SHA1
0452d014af7d0209a8d7c6c686551723bf4b492b

SHA256
cd2b3e3cec6a019bb4a4cac8186fd3b128252f1b43e656cbee89ad253af14be5

SHA512
e4b31dea20f35b29059dce529e0122f03db7fbd5ce41e9807b93a2f0409c2fd290d7dcca3bcfa96568dbf11b57715e348c068ecab4a5de239877b0aadeeed6dd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
2daa42633648408dabf74556758180ae

SHA1
c4dbb38511c4a4dc8b7785ba9965bbf83a323d05

SHA256
844795d1f556acf38a6b956fb6023a758b606c9dce1a4460371a16ee6ea6bf0a

SHA512
b0ad7d94a7ee6f7a3e521c47dd36e26a19beed8d458f5006629ee77bf14dc6849e15e5939074f065ac93c48619edbec73e7697598ef732a84dd5d3bfb3279363

Download Submit