f6ba97ae6b03c4be15521e865e0f387527e2a62dd425d3c9c87979e338beb10f

Analysis

max time kernel
147s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
19-07-2024 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5b48d82580a74d83618e9fb92e6399ad_JaffaCakes118.html
Size

236KB
MD5

5b48d82580a74d83618e9fb92e6399ad
SHA1

2e4b5a2d04a533555df77e816a9427c5983a7a9b
SHA256

f6ba97ae6b03c4be15521e865e0f387527e2a62dd425d3c9c87979e338beb10f
SHA512

9e4d0588df8a10443a2f81624b92b0db7441849303a1c5d1aeedd86cde59c105b6be4a1d0f5429fc2f915653f2476132bcf0a412b130e115b7969a37f32291c5
SSDEEP

3072:KT3IQzzmw7PN/8xVonaUwlTFcxtn2bbeOwAS5FY+/555T39v4vO4ebcVC4e4pU7P:aNUxV6KwA4339g6Km

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1720	msedge.exe
1720	msedge.exe
3168	msedge.exe
3168	msedge.exe
2040	identity_helper.exe
2040	identity_helper.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe
636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 3216	3168	msedge.exe	84
PID 3168 wrote to memory of 3216	3168	msedge.exe	84
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 3912	3168	msedge.exe	85
PID 3168 wrote to memory of 1720	3168	msedge.exe	86
PID 3168 wrote to memory of 1720	3168	msedge.exe	86
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87
PID 3168 wrote to memory of 3924	3168	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5b48d82580a74d83618e9fb92e6399ad_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff43a146f8,0x7fff43a14708,0x7fff43a14718
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2184 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4728 /prefetch:1
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4092 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:5020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3924 /prefetch:1
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5864 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2116,9314285146848409089,23115108153292661,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4688 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8dc45b70cbe29a357e2c376a0c2b751b

SHA1
25d623cea817f86b8427db53b82340410c1489b2

SHA256
511cfb6bedbad2530b5cc5538b6ec2184fc4f85947ba4c8166d0bb9f5fe2703a

SHA512
3ce0f52675feb16d6e62aae1c50767da178b93bdae28bacf6df3a2f72b8cc75b09c5092d9065e0872e5d09fd9ffe0c6931d6ae1943ddb1927b85d60659ef866e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
1790c766c15938258a4f9b984cf68312

SHA1
15c9827d278d28b23a8ea0389d42fa87e404359f

SHA256
2e3978bb58c701f3c6b05de9349b7334a194591bec7bcf73f53527dc0991dc63

SHA512
2682d9c60c9d67608cf140b6ca4958d890bcbc3c8a8e95fcc639d2a11bb0ec348ca55ae99a5840e1f50e5c5bcf3e27c97fc877582d869d98cc4ea3448315aafb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
991fa76ce0c0a7d28652137b444834d7

SHA1
41d9293c6fc3c3d97ce86c0986c00e8f064413fe

SHA256
a795884044f7e715c6cef24e8961143cf2c9c13493b227369589a54340fbf797

SHA512
dcbad14daef4117434decb62e140120b04f1f9bd56a0a8473b676f17b48f99a7f8352091505b835938628517c74921b4930202a3b99f210025f33febb1aa3992

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
d33964119ea96f75fe3f47bdaae64ef9

SHA1
1161bd20a8cbbc6a23205f17482ac16289b56b51

SHA256
b60aafa57c23196702acdba9d10234615d0b4b5dbe3fbe65fa22ad435b26480b

SHA512
53746f1010ecf7ff835267d7c4c2ae11f79b4096723eb2fca38542ba078b3da7b250c2151cab6b46ec89e0e13c77c7b16e00b0128754c33fc26bcc938b2f5482

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
554b1e1740c639caa981f8bc24c0078b

SHA1
40f70ed4c085ffa245aa192d45329262938da77c

SHA256
63f582b60ab2103ae7ff405c2e0ad06c40339e66ec91a2edac4bd31485e606c1

SHA512
86ca6b66dc8ee46a03155a7035a152eb840055e7dda53b84459e6b597c2642962782bed7bdd8ab0728e18749be1b314bfeeb72221503c02a0b9c7bc1f42f917a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
5af6b1f89e61269edeaabd7d17955c06

SHA1
b7ab54dba9a728a54a6d983f1f4462d88bbc7d42

SHA256
faced7d8a4640cf13d1aee3be80edd44fa4b008571ec50c73deda09914a65a33

SHA512
8d7dd7f81f7bc6052e024ee5d7cee812cca3751f86c050b62e629acf5726e171bcf8c4333c74302ae106bb9d27a1811588ffd8187611a6e46bad0030fcc0388f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2d380b0e76676f28f7d352e230022ed4

SHA1
084123545b35d07ec73a75fad7c36a1167cbdbd3

SHA256
2d6867eed85cd46251edfc85f9126432a94fcb9a307bdcec1434edea1100de2f

SHA512
2a778799de2d364a3482f618f7c1e12b3e51924d09d11c0954316c2f088c33dad457b1ba36d8c5af6169e5daa462c6569948142d347ea38cb005c931a0ebc43a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
180b29d8a6a2c24fdc3d5297019f82de

SHA1
a0560e9af1237f9847f42b402492fd92d7658c80

SHA256
0837db69e67c11ba8e0f176c2c5542682a1660b02b25908ef65ba8fa30098174

SHA512
0a82a9366b7048e2b7ae500e726763bcaa194c2edf172d1b5f7b1fe825660b930360a8b732d7720befd6065b813e6a6c40caa10edc2d56b988a9af08a3ea3393

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6175d11e3020f55a50af42f59c6eac51

SHA1
9a77e1fe50e1281464f28a386cdd2619fd125e67

SHA256
f176c308f7f4b7fbf649769d072e41a41422eb8d71df738941b80e537d14244d

SHA512
aa45a946cfb94cd85b3667ad60e7e24b9c368dd10c2a488b85636d2662fa40ea26a9829bd23cfcd2b9387e5c8303840dd3a5b804e8e5e5fb754dc8414ef7306f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
76c56cd2ed3faf548d4a3958ad014e96

SHA1
a80c0e384c5814c2557efd3cce8753adb38c3e63

SHA256
5866cc6011c343c5782c39933a0f2fbb3ddfd66500317beb97eecfcf194f16c4

SHA512
38cd33cb70433a6ac599b9b3e4f4619f7d16d3a00b853a3ac4252ac22c0e3a3c4ad893430f0acb46b70653c12629e2048f2b20d186db77fce0acfd38de7a8dd3

Download Submit