hxxps://thepeacockproject[.]org/wiki/intel/installation/

Resubmissions

21/11/2024, 10:47

241121-mvkmzawker 3

21/11/2024, 10:45

241121-mtsl7a1bre 3

Analysis

max time kernel
56s
max time network
56s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21/11/2024, 10:45

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

https://thepeacockproject.org/wiki/intel/installation/

Score

3^/10

discovery execution

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 18 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
220	msedge.exe
220	msedge.exe
3544	identity_helper.exe
3544	identity_helper.exe
4816	msedge.exe
4816	msedge.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe
5564	PeacockPatcher.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	5564	PeacockPatcher.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe
220	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 220 wrote to memory of 1744	220	msedge.exe	83
PID 220 wrote to memory of 1744	220	msedge.exe	83
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 5024	220	msedge.exe	84
PID 220 wrote to memory of 1168	220	msedge.exe	85
PID 220 wrote to memory of 1168	220	msedge.exe	85
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86
PID 220 wrote to memory of 2096	220	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --single-argument https://thepeacockproject.org/wiki/intel/installation/
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffa5c2046f8,0x7ffa5c204708,0x7ffa5c204718
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4904 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5512 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --service-sandbox-type=collections --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6552 /prefetch:1
  2⤵
  PID:5480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:5488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6164 /prefetch:1
  2⤵
  PID:5780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2248,12001037604821349549,11576084448156370761,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:5788

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2324

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2592

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4172

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:5288

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\Start Server.cmd" "
1⤵
PID:5996
- C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\nodedist\node.exe
  .\nodedist\node.exe chunk0.js
  2⤵
  PID:6100

C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\nodedist\node.exe
"C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\nodedist\node.exe"
1⤵
PID:5424

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\Start Server.cmd" "
1⤵
PID:5116
- C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\nodedist\node.exe
  .\nodedist\node.exe chunk0.js
  2⤵
  PID:5184

C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\PeacockPatcher.exe
"C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\PeacockPatcher.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5564

C:\Windows\System32\WScript.exe
"C:\Windows\System32\WScript.exe" "C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\chunk0.js"
1⤵
PID:5532

C:\Windows\system32\cmd.exe
C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\Tools.cmd" "
1⤵
PID:5968
- C:\Users\Admin\Downloads\Peacock-v7.4.1\Peacock-v7.4.1\nodedist\node.exe
  .\nodedist\node.exe chunk0.js tools
  2⤵
  PID:5720

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fab8d8d865e33fe195732aa7dcb91c30

SHA1
2637e832f38acc70af3e511f5eba80fbd7461f2c

SHA256
1b034ffe38e534e2b7a21be7c1f207ff84a1d5f3893207d0b4bb1a509b4185ea

SHA512
39a3d43ef7e28fea2cb247a5d09576a4904a43680db8c32139f22a03d80f6ede98708a2452f3f82232b868501340f79c0b3f810f597bcaf5267c3ccfb1704b43

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
36988ca14952e1848e81a959880ea217

SHA1
a0482ef725657760502c2d1a5abe0bb37aebaadb

SHA256
d7e96088b37cec1bde202ae8ec2d2f3c3aafc368b6ebd91b3e2985846facf2e6

SHA512
d04b2f5afec92eb3d9f9cdc148a3eddd1b615e0dfb270566a7969576f50881d1f8572bccb8b9fd7993724bdfe36fc7633a33381d43e0b96c4e9bbd53fc010173

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
1KB

MD5
0de9b7dd230d02821bd1ba19039cb3c3

SHA1
94bfbfbe034e2abcbe051b1b4d6caeba9ae362ea

SHA256
4b30649ede9a148b7a5c5999809df2f391a084e8c28f8d3d3318c6c26ba3cb08

SHA512
ecfcc3a2f91608f428cf2561607faaf88393a1221a48a52abba277ae100c0317a830e5d54144baccb85518e6c2f18b6394eefd21c2e02ac06f80793cb9b58709

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12f4eb6c18d5cd0c6ed71ddd4269de92

SHA1
bb2e24c859bda7c27d8951e527a43e98a34531b2

SHA256
168eadd63b56308dbcb1595a879a0e247610e7cd0889d7149766abced2256f15

SHA512
5ce4f7e147cf5f4c4bfe163836bfe068905fc9d1ca4a30f221830e8060852eb2bc5c0513d33b8ef830e959c8cb6a2dee3776f69d3129d8034cc8b0be6d7e8ae0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cd0e174800125ebcaed0ac8a4034ce52

SHA1
d8981fcf666ab54b32b6d63f699a9e73ef4e54c8

SHA256
06e6538d40dc0fc82bd31ecf938076244f881da432199703d457451838097c1e

SHA512
0f488657f7871558f20a02971fbda01868c02ed7aca6447cea4d24adb513b1e30b46df87894dc4827ef5537edd59a4536b32567899aec764745131a6792fe2b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
f5838b9bc08f8f8404b5949a28274148

SHA1
b1b997f25fa66823c8866331efb6db0bd451d1bc

SHA256
468179a07a2058700e599d12851024dacfb6ebd827cc0a132febbf591cad2b3a

SHA512
489322ac624968c8928302084d9368fc00e31763c9a006cb2f6a59f08ad96963bfd3f31bfd0817e5a0dbeeb810081b1e0ab4868a0d3dcc6c32cddb5aa656108b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
35B

MD5
343859b4ad03856a60d076c8cd8f22c3

SHA1
7954a27de3329b4c5eefd4bdcb8450823881aad6

SHA256
8c79b653c087618aa7395d5e75198da7d3b04c08654c39e56b1027f9ef269c2f

SHA512
58014a4e7f2b4b0d446fae3570196b8fb95d0d1b70bdab0dd34a74d6c62cd8d7ca494a486f19c1a829988a3af83a08d401f18d1769ce1799a02ee09807234254

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\32cadb2b6d359d069dd3f3d132c212a43d223701\index.txt

Filesize
99B

MD5
3ccd0f9223acd89db589fc7fbb46cc33

SHA1
12d6e03374208e1804944f61728a096182ecf854

SHA256
aab7a76afbc8f3498a0ddda93d5224eb77fa4f2daa45db6205faa71478eb68ce

SHA512
3a190a02dc4138e49279df0246ad723f6d8ddcb7a0b7eb689851292c0f866f7d6cee7daa18edab82e912b48e6f4908869218a03506d3306b55966a6ec047c1cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity

Filesize
1KB

MD5
f84fba1cd60ef9c80f8ae8803c938c31

SHA1
987124740d9a202574f28099eb3b2eb957a76344

SHA256
b4117bbca57bc585c532f43302838909d0b8dbd93e54dfc92c12b3e4e1922a4e

SHA512
5fe25aea3aaa4d88a3c2e383351aebf92cc4a53ad2af9cfc618d238714ef25e1907622ee26410ce1af4327968af7634a254cc865fbab8959f122e0b607395212

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\TransportSecurity~RFe57d774.TMP

Filesize
1KB

MD5
c5eedfa2e1bcedadd0015968f66a4b5f

SHA1
df4820d1449339e1e6181870b54fc614df84837f

SHA256
54ef64eeec63096ab449551a39f2d9df61c2592376e51407845412cd8782f16b

SHA512
308574bf07ae1148acfacc545520d214576d8e0504a0258404fe8970eb5bb81d04f70cde53b281818c8c4e0a70c4c854c3b1a916c2961e62f3c125a8af618c54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c120e47c7dc0ea7d16e10a4ac9844455

SHA1
397e80d6e1a93808a99642a2362c2d32ef10580b

SHA256
929fcb5a8e003eba9a85a73194857cb9050e84a45fc01c6e7daa3cc660d64518

SHA512
966d7fafcfa8b0c79ef63a17008f53f11770b824bdda6edf99fa768aed6e83ae729bb5be8a1e3904adb9a24ab3ec5e29c7a5e5f721f7972481d0ff0f8689af2a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
bf96b3b1962c88c40bf411fcc459a891

SHA1
03484dba0113664d413593101a7d08fc9d0e14f3

SHA256
0f75b617ef205d5f884a72f6ccda7695f827016fb00f294ceb949dccbaaab0f5

SHA512
21236a5a5dfcead17b75e75d6eab9fe28393713c82990d18b79948ba2e1320fc570df64216d847510f481182329c33830897dcacad32f48e3ac750e89a06d99c

Download Submit
memory/5564-276-0x00000244E69A0000-0x00000244E69EC000-memory.dmp

Filesize
304KB

Download