6124228552bd8a7122fd9f6838360a92ce80ed75f58d4fefed48e024f16408c2

Analysis

max time kernel
146s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

d6b574560278b6939a0892cc59f21bdf_JaffaCakes118.html
Size

1.0MB
MD5

d6b574560278b6939a0892cc59f21bdf
SHA1

865b9845a3b3080312a542b63448bec4fdb909c2
SHA256

6124228552bd8a7122fd9f6838360a92ce80ed75f58d4fefed48e024f16408c2
SHA512

73a68c4a656624180337c9e6958ed8b152a146a75c74d2ae6fbdedd4063b6b578598c7f41d2c0d3880d6c50b8f594c967d1b6e6c21a92f19a2bccdf356707b46
SSDEEP

6144:tkclxZ4UQ6Y/JBDRl3LHhFKB/SKbO6/lsE2HG1qxt+GPaqFZV+rW1bWQ:tkclxKB66BDRl3LqBZ7xq/1l

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
4860	msedge.exe
4860	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe
3164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe
4860	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 3616	4860	msedge.exe	83
PID 4860 wrote to memory of 3616	4860	msedge.exe	83
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 224	4860	msedge.exe	85
PID 4860 wrote to memory of 704	4860	msedge.exe	86
PID 4860 wrote to memory of 704	4860	msedge.exe	86
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87
PID 4860 wrote to memory of 2512	4860	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d6b574560278b6939a0892cc59f21bdf_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff904ef46f8,0x7ff904ef4708,0x7ff904ef4718
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2100 /prefetch:2
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2052 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2736 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4148 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5040 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2012 /prefetch:1
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6316 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6452 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6036 /prefetch:1
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2084,3395775515851023460,434724836812887600,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5028 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1244

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
399f34dfb42b8b5371d01c5305094d08

SHA1
44163fb39cc196438daf01639bbd9b0c22576459

SHA256
cd64de78f1181df498fc2eedbc3624f9c473ed5b4c2560238311a31e98789c81

SHA512
e375f8f5a44abea39499f4a6671ac2bc62a28357f8f58a53519acf6ba47fe31b1eba5cdd66290c2390223aceb6ba872fa5d38c6b0e348f80befa3d44173401fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e88fe906609992637bf3fd222bdbacfb

SHA1
ddf335d621fab719a5cbfd76d2187864e3bb7443

SHA256
322527dc6f9ed5c6294d1c4693333d02a724a669ab08bca43d4547c621d1e3ed

SHA512
0533f9dd958fa06c6b4870189c83424e02b5f1e5376236205e34be08c90e6cd4e18f9c9f63948c1bc2fa3ee2a7d622214e2295d1706e3396774a3308b909b43e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b9133d31b8e9546ad52d8ed1a071da91

SHA1
15235366e303b168c7ca580434faacf67b29a481

SHA256
2494ac71b583a951a6b338efe52ec611627a95b6731bee5f38224d28aaf864fd

SHA512
693cc2f1393f3c316782cbb3f8b23ba4bed3521385ef66aabb0a6ebbb55f248a2a1907aa385f335443f47fe99ff43f231d44b67888a9e2db928cb673866a3012

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6dd6fe326758ba5689f0bd22ab7a4a60

SHA1
4b4a66510462d8869bf43128574500e043415843

SHA256
3f4b48212b3ec5e6998e25d4bbf1b7b91b30d286f47bbf353c461c3e608f3901

SHA512
d4621face5055eb7adf58c8381d1d5f168f439b712f15be6de3d84adaa14dd152f96b68116bdc69949da5e17c96f3ad9b477f9bf756b4eefc47e410fa38469ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4263872a4c73cf5a7210fbddd242d095

SHA1
5a6003f86d4f5ac5ba5d699caa5c9f23cd237293

SHA256
83049ace1698ff150b410f14a54c6a334e0c364a01a74a2c8b429e44d716ac10

SHA512
5396452da40747d4a450031df3def5f8ee75244791b815f878fe5386cd647bb9263ad9ed9aa8d7cbf4bad39fa51a1eb289dd6e9c5435f547097211addf37df76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
732fc66c66fe2370b33bf2a9b8ecd5c0

SHA1
394ba50c4a2aa1756424fb8fa2377790b270c7de

SHA256
79fc7a98cbaa8307df16a0129e9dfcd1e0bf1d3023313debacf353081d0dc282

SHA512
60ada08f6dc947ab2dec51a67f57a9584fdbc1ec55c0dea1062c95b4384b9a05c0b9a9927a755f95ca180f5bf5966927c5f8d27719495cab6e154d31b44f19af

Download Submit