5ba8a025bb782c43dccb5f7c7c44491032cc24fc1e288fd63eb3163db9ee2324

Analysis

max time kernel
145s
max time network
137s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
17-04-2024 22:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6b554d6b03d5ac36d65b8709a1a9c85_JaffaCakes118.html
Size

35KB
MD5

f6b554d6b03d5ac36d65b8709a1a9c85
SHA1

e33498605f18996176d41978db06cbf81295f429
SHA256

5ba8a025bb782c43dccb5f7c7c44491032cc24fc1e288fd63eb3163db9ee2324
SHA512

cf4b17e14373347e013b9f84990f45311263a21324c84ae2dd921d424bba722a8dc436cbdffb4ae20182dde3b5c343649753738a8e909531438ffc8383ed4db8
SSDEEP

768:4ayHHvPWlnXbHVjmi98raxEv6WPlruIJ9:43HH2lnXbHVjmi98r9hPlP

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe
4156	msedge.exe
4156	msedge.exe
2524	identity_helper.exe
2524	identity_helper.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe
1316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 3524	4156	msedge.exe	87
PID 4156 wrote to memory of 3524	4156	msedge.exe	87
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 3192	4156	msedge.exe	88
PID 4156 wrote to memory of 1444	4156	msedge.exe	89
PID 4156 wrote to memory of 1444	4156	msedge.exe	89
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90
PID 4156 wrote to memory of 1952	4156	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6b554d6b03d5ac36d65b8709a1a9c85_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xdc,0x108,0x7ff8b8ac46f8,0x7ff8b8ac4708,0x7ff8b8ac4718
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1952 /prefetch:1
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6044 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6304 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6952 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5480 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,3456566619075060938,4311455208083821950,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1316

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2424

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3632

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a9519bc058003dbea34765176083739e

SHA1
ef49b8790219eaddbdacb7fc97d3d05433b8575c

SHA256
e034683bc434a09f5d0293cb786e6a3943b902614f9211d42bed47759164d38b

SHA512
a1b67ccf313173c560ead25671c64de65e3e2599251926e33ce8399fde682fce5cb20f36ee330fcd8bb8f7a9c00ef432da56c9b02dfd7d3f02865f390c342b53

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
cb138796dbfb37877fcae3430bb1e2a7

SHA1
82bb82178c07530e42eca6caf3178d66527558bc

SHA256
50c55ba7baeebe1fa4573118edbca59010d659ea42761148618fb3af8a1c9bdd

SHA512
287471cccbe33e08015d6fc35e0bcdca0ec79bebc3a58f6a340b7747b5b2257b33651574bc83ed529aef2ba94be6e68968e59d2a8ef5f733dce9df6404ad7cc5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
1698e9df91e5495b43e8bbf219e52145

SHA1
2ebfb5e0ec35b1fc5c2b271bc4c28db287dddf2e

SHA256
298c35e8565e74d4a82bfeb4c73357e8292782dad1ff14a615266596f4241f93

SHA512
5076071b181a28248f3e1a27349bbf0f987dbb77793c49ad685c523757ca7638d462aa52bb729eefedbcba3fea11af1ca06eed0c03f177e3a406cba9a4016d67

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
ddc1ef8e5179ed31ac29126e07e5633c

SHA1
a241161f39fb60ce2669579241046b45ff8c22e6

SHA256
c5c8ef8ef95d949140b73266aa28e966c63af83f94ac920e85716e032f00ae74

SHA512
2ad95813ef746ed735b57cea21859803e445f7080dabc287b49c1627323d5afe09f2a96b2e0a9e5104917cc2d23b2afa0f98fd8b0194e3f9df31d5f083a4d71d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5ad071fb4e2e227983a55892c67f8ae2

SHA1
655e7adf31a9d586d1594447dbcee09bd6b64282

SHA256
4f45421396bc2d67d3c4958982d8ca903627846ac18560e0539180213b89b2f5

SHA512
f945f22dc71af4252b1c6abcb5ac0fc7a5c49b00ba24ae4b1d60f7a233f356183673e90359a31ddb185842dea7c400854e9a1aeb3743372accc62fd2ab1d7199

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
136f3a6a742ccaedf0906f436fd9ca56

SHA1
2d9c33a94523a38e3690603459ea32c4d1e5af9d

SHA256
3237e99830f80f64aaa16b9e7c59260b167f3acff0ee4e371e1b8fa5fa0dedb5

SHA512
7ebae945349e31193ada0d897fb42e6ff96ef24de48e74d9a52aa86007a9ce56569d94e6f9cdd683b1d49753ff0efc65bf7e63c14629682455c4fb93d42b6391

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ab5cceee64f61c0cae6c6b5eb5d353b

SHA1
6b95f4aac351c5898df0941e55c16198ee397809

SHA256
719cc49c9ff1cff2db623faa1f10d08267cc2795dd401e0fa1847c01c5daa7a9

SHA512
0811675ac1ea6beddf5b0a33a2bf211f48764b266070b8b8e28dc45a036d9fecad0293fd44ace91c08930f77f04ca6a9a010dddb34c48632f42b90ddc07c360d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
69708c466371996034c6231ff3d4bb54

SHA1
05a5f8894c27a89dd49d79f262d4684602047f65

SHA256
a49662e70344dcca1abeaff46163bda31e58565531ebe7c2e90f134ed6eed908

SHA512
162de5f3fda31fd25ba2ffd547e50eb8721847cea2d1be343f47e93736f66e43ed83f194d479a619466e00f7f191b29475fb4d5a3d167facea45fe4f0f37c4fa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c4a50323b012edbebe86493ee16a9baf

SHA1
7962d8cf5b50d7280feedaf896f6f7456bee432e

SHA256
e8e9676956fca32c35abb09687ec363254a839b490f7a303280fb83b866c0fcd

SHA512
b8ae36f4f53401b10ab8a1aeef551f730a7fb7220b9abe0c9fccffae0c05decdfa85e053149b11475fa08425e8982f7d9dc422a267da37094614dc8528b9cc87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
020536796e108b19bbee99181cb61091

SHA1
8de930965c26f42d1ff98974fdc4f5083e94a778

SHA256
16acc96390d39e88acc7f14f1b67a811b0c324465f124ac6fa68a6aad92b1f52

SHA512
ea4089935a06f7484b6aed10757e5d9bfc0bc243abcbdcb16c7204b70b09279b9d6a593ea53dec38d197fdd8d2e83b32e7ed507aaf84e4db6862240e4604cf9d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
12921adf2e53881d3052e889289a64a2

SHA1
cab0cad467111b109e5b5b5ece136399bcfdb791

SHA256
26e68aa87b61877d88da723f11f22a0e64ad77b98207832ea251392f04754653

SHA512
b779d7313a64fb91fe6fdc5cb764ce27f2f72c71acb6626bd9cc18ed693b45f9755b02f41bfe737d3ffc0326af58d655d9e86f82b4a2acca4f3908dfc2e8643b

Download Submit