c3f97b3601d799efcfe1db455c42c00383e618c04e22705f2f9825fa96676188

Analysis

max time kernel
148s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eacb6ed0bd618204a646e99defb6ce80_JaffaCakes118.html
Size

131KB
MD5

eacb6ed0bd618204a646e99defb6ce80
SHA1

93dffe6b0626b0d223697706b6517b341024cfc0
SHA256

c3f97b3601d799efcfe1db455c42c00383e618c04e22705f2f9825fa96676188
SHA512

8e2b4bbeecf14b2a3cb9a9229a70db176c472ca1d20c42085271a9826e6a47c07d995e5aed3f2ff2f20bc23a5b793da749b83a03ea6d5d04f8dddeec8f929f37
SSDEEP

3072:OCAfAZ9lHyho8NpSVfYoZDRntrxmUqNbrZSm:HAfAZ9lHyhGO

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
1036	msedge.exe
1036	msedge.exe
2332	identity_helper.exe
2332	identity_helper.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe
4980	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe
1036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1036 wrote to memory of 216	1036	msedge.exe	82
PID 1036 wrote to memory of 216	1036	msedge.exe	82
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 996	1036	msedge.exe	83
PID 1036 wrote to memory of 4632	1036	msedge.exe	84
PID 1036 wrote to memory of 4632	1036	msedge.exe	84
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85
PID 1036 wrote to memory of 2644	1036	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eacb6ed0bd618204a646e99defb6ce80_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab4c846f8,0x7ffab4c84708,0x7ffab4c84718
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:2644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5108 /prefetch:1
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5448 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5868 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2216,7120691963903083940,14729416967842007260,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5620 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4980

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3572

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ff63763eedb406987ced076e36ec9acf

SHA1
16365aa97cd1a115412f8ae436d5d4e9be5f7b5d

SHA256
8f460e8b7a67f0c65b7248961a7c71146c9e7a19772b193972b486dbf05b8e4c

SHA512
ce90336169c8b2de249d4faea2519bf7c3df48ae9d77cdf471dd5dbd8e8542d47d9348080a098074aa63c255890850ee3b80ddb8eef8384919fdca3bb9371d9f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2783c40400a8912a79cfd383da731086

SHA1
001a131fe399c30973089e18358818090ca81789

SHA256
331fa67da5f67bbb42794c3aeab8f7819f35347460ffb352ccc914e0373a22c5

SHA512
b7c7d3aa966ad39a86aae02479649d74dcbf29d9cb3a7ff8b9b2354ea60704da55f5c0df803fd0a7191170a8e72fdd5eacfa1a739d7a74e390a7b74bdced1685

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
f5e1711c191437796bcc94d324e43154

SHA1
74fddf70e88bc6c422c11eff47671461a4e63022

SHA256
9daf46dc858d874e8b9b29298da26773fa1f7088d24f2073c8a98df356b940ca

SHA512
ee1b8afb3032329870108679e1a3a7475e9bd7e84f7a152f627a98916352208475974b45284aa05197effb71681f1478ef98d84db2fa05fcfddfffb1c814138c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
1301a6718ab00220cf6421aefe54adb0

SHA1
0fec56a6465635759a5a54ed9c57c0ea02b068d7

SHA256
4e2c3a1c12e500761f238f73b25aa6fe5122e6d290221483ac741166d5d4008f

SHA512
c33fe1e1a5426a69052db6968e1c0b9797aa0a52ef8b0ad557bfdab74b6fa3e3d80a24e4fcf44de5fa8992779d2e09bfa664e0bf672a58ef5ca6b09923f06c94

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
40c0494202e46f865321e8068da836fa

SHA1
52dbd8899e57045bdad3f1889f900ca52b58d73b

SHA256
70e0ad9d8f71ba5f2fe7c805f0d8e90b992a77d6f7d20e330bdedc0dfc540f11

SHA512
9255890a606110ab7645b0eeaed632a13887a058a1358cd872c5fc40344bf303b757895251cebcc1d1a7f2d08fdbaf81461a552fe4e98fc5649bf1b1c007102b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2b58f3195438e9bf980f89c841679299

SHA1
2ed7d103091d64867a8a403d0720f263464c261f

SHA256
3428431530b19bea56a6d53bb7c1b660339fdb82601462af4286f8cc24a3a8e0

SHA512
074636ed5290031c041167d82cb4fee402ccfd30e7b53e2b8105b4c0b9e842a683e6236d3a1b4d7f448e7e1d0174d30c49bfe31d6a8fc66764b9734bc80dde46

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
1f3c0128d96bb956c767711d6172158f

SHA1
c25d67c969c876ecf4e4f2fda4ec85fa979cac51

SHA256
0250c655c6d43d9b7d35bfb207579092e8b0e3159e2979991c8c2df1690a0687

SHA512
4a25c3c94740c1d8e25b5d1bb2bd990953e69adcf87106bcbe071b703db0bb514ce449bb5f388222d3e0eb8087861ed9f1a388d088571ed9df7afbbfe4fb9d8b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f56a51918a3e9850c80cd4c67252899d

SHA1
1de819d93f06bbf0feec79b8ce46e7e482fa034c

SHA256
00b151b2c7de35563e1a4d842d0c62d829dc680e0cf09d9d03a93fbd8ab03e9e

SHA512
dba1703c95cc83c487af20f9817fe3b1dc71e18d81e192b25c8b849252858286e5f2be4189dcaa1c2c1cab35e662503dbad50f4245b4b5b144a3487a173f5f17

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4c8e4fc93beb27ae8958175a508283ef

SHA1
4d76e2df9531f15f7605b474db2bfb52d288490d

SHA256
1f28818502aaf9c4ea60cd9fef16a32e7628c64adc2cd88b8601dc264ef4dda5

SHA512
cab6455b7aaa811aa0da3979b5d0183b617a488c02d85ec4ef82e5b96e8747e62fd1e879eb37a50d066065e35593bc5c9570a9c15557524cceadbe1c43544c20

Download Submit