b8d4c60b2171c6aeeddf2ab863449a8fab682f50aabd2347a52e88f60c4f064b

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240611-en
resource tags

arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
submitted
15/06/2024, 13:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ae9389bc98b70f6e45fb8a29cb4dcd0f_JaffaCakes118.html
Size

63KB
MD5

ae9389bc98b70f6e45fb8a29cb4dcd0f
SHA1

e2aca22c7f3c88985aa2d3010d76635648026b02
SHA256

b8d4c60b2171c6aeeddf2ab863449a8fab682f50aabd2347a52e88f60c4f064b
SHA512

72c4eeddccc51c761a81b7fdb24fba1702eaa2b96d3af2edb99c547ea9ecf4ac0a351e1dd6a331fd39f0aa3b6c2f959c507153c6c5d8c1d0d2ea4eb1a6655e2b
SSDEEP

1536:q7jdllJ4UkT0bVJwyxxVUpKmO9vgv99Z0C:q3d3+LEV3JUpKP9vgv9P

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
112	msedge.exe
112	msedge.exe
4088	msedge.exe
4088	msedge.exe
2928	identity_helper.exe
2928	identity_helper.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe
804	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe
4088	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4088 wrote to memory of 4628	4088	msedge.exe	81
PID 4088 wrote to memory of 4628	4088	msedge.exe	81
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 1012	4088	msedge.exe	82
PID 4088 wrote to memory of 112	4088	msedge.exe	83
PID 4088 wrote to memory of 112	4088	msedge.exe	83
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84
PID 4088 wrote to memory of 624	4088	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ae9389bc98b70f6e45fb8a29cb4dcd0f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xdc,0xe0,0xe4,0xd8,0x108,0x7ff9a24f46f8,0x7ff9a24f4708,0x7ff9a24f4718
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2068 /prefetch:2
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:2184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6852 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2748 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1844 /prefetch:1
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,622513177520572317,67509568133739516,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6968 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:804

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1680

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dabfafd78687947a9de64dd5b776d25f

SHA1
16084c74980dbad713f9d332091985808b436dea

SHA256
c7658f407cbe799282ef202e78319e489ed4e48e23f6d056b505bc0d73e34201

SHA512
dae1de5245cd9b72117c430250aa2029eb8df1b85dc414ac50152d8eba4d100bcf0320ac18446f865dc96949f8b06a5b9e7a0c84f9c1b0eada318e80f99f9d2b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c39b3aa574c0c938c80eb263bb450311

SHA1
f4d11275b63f4f906be7a55ec6ca050c62c18c88

SHA256
66f8d413a30451055d4b6fa40e007197a4bb93a66a28ca4112967ec417ffab6c

SHA512
eeca2e21cd4d66835beb9812e26344c8695584253af397b06f378536ca797c3906a670ed239631729c96ebb93acfb16327cf58d517e83fb8923881c5fdb6d232

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b80ef32-731a-46f8-87af-8bd3ce98c172.tmp

Filesize
2KB

MD5
56c2d102967ced054f1dd3ce5e8c0ffa

SHA1
2877879cbd6484d8c46e79210f4102503f08d1ed

SHA256
b173fe9bb348d1f7598d8d8fcc1e32ae3df60b8b23f8fa993940ee89dfd332a1

SHA512
4bbd7556b3517c28f24c4ddff07250e6367153cbf3e510d4cb1f1f1a2423c52332f2d11a38f451d7032606b09378043702f3c526ef5f3b6ba796578e015e1de8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
44KB

MD5
23536ccfe05b737ae639fe63ee4cc435

SHA1
6d2e9822835dc3e6117a4d2addfc8f241fbdbc82

SHA256
6ae9edfc411ede03661a3d910fafddab3d6b313d1f4668dc8c5a84c5ab23a3ce

SHA512
f416e36b2322bbebd211fd1ea69c88883f00c7b00f14474a5fcce4a408840c0d1b0304eb8941509a38157d0583485f638959eb7d5b9ae668aa88c1d3eee8dd0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
394b69ded2b38de117ed3497fa873224

SHA1
0eff3ca2afc152590fdc81b2cde48a548970ff22

SHA256
f8744dae29bbddd1148ba87932719b5bf563e8f6bcf9994bf34518899d9591c8

SHA512
2c5c18992824b8f5cfda0c5005f6977127ad3e4ce0409b10047468ad0d095f5d6dd42f499b58694157cff614751fb8c57cd35a90f477c8180a716e72d3822326

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
ba22e2973ee90382c5fe0ff892a3ab62

SHA1
e9d491dbe5de8b05ce50f7e75b17df672e01a77c

SHA256
28b2912f69266433c6accaf0dbfe2c441f62705f3cc2896caa4b345e1cf67b97

SHA512
c635cab8609980e9c0fdcd15afbf7f42f709174e389527add60f7154dfa76321ad93e330d875b6f8d5e530895cfa57530f2a404436283b2aea71efe0112a536d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
8248e4d12fc7c791e721dda9643f41af

SHA1
e19c89b57eee0bf6835eb43257f6ce73d634d6e6

SHA256
5e428deb8d68ac3aa52b60eee2e152d67755438540447dad1bf1a00b29ca2e7e

SHA512
4f91521ae0321a58ce2bc365ae89879d73029600521de85d23291ef38a1e454b205f32d7ac3e1a69e6ea4133b671f196b9146610935b78f6d2df21a3386eb7a1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f76346799b06230a83cae92bdcd489f3

SHA1
99e579d239d29f2161f3022ecbf71199cff6d223

SHA256
7199c8daa480749bb178db3b96fef1d683eca4afd1a66d304b01261887af728d

SHA512
f9ae02a7f006d556dee3ca4f7a6088441114d155dcb740190021611022cec720cca994b03c828d2f21e58f3470930c72ccf3fc44c3dc22ba3f0630d0797c6c4a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
f010feae0a96f06703676ed2648c4e3a

SHA1
b720362a4fac4131a1f223f658a9cd9a0be1594b

SHA256
b2fc5bbd1310b5c548463660e4501ae239b117aa84804244a26c48763cb83a16

SHA512
0df9ae193c73f9640da53c6f2f3cddd08fd1c6226860f46ff62f402233db4150144b59266b36d04f1c4a161c0f24b2a61926ce0cb0834413def8ffaf2944b960

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0e2b461f83feb786d9983a21092481ab

SHA1
8df3a504eec3488b246c6144b9f96344be2a7112

SHA256
dcabd410b4b41c34a6c56fcaceb6e1651fb8995076ed52d8c05670f9b3902d77

SHA512
8857618e957ec104eab9520fc7a83512ce7c928d80cc1208122ac022122e9d78259ecdf86dfb05369378d7df2fd7b364341eb72ce211f7f2a797e1caf9e8e93c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
b2aa2dec7ad16a4ae654d29179ce7ccf

SHA1
05cf4bc42032c9dd427128030ac4020d252b82e4

SHA256
f75aac748b6534ed49b089f84704164b7825bb5aa3450ca03369d1be0ea9cab0

SHA512
a03970f50c4053637c96c40cf20efc2308869ec24a83ee08ed5f2cee28fa19d2a7370af2afa93bdcbec340446a279ae0f434666256a84af01efaefbdce36ee5c

Download Submit