7293cc1ce0b759ae27249d045c8c258c29f22a4adb35f20e70c221e06c7fe8fe

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
03/05/2024, 03:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0f90642b0b0a71b1a11de53db8b22dc2_JaffaCakes118.html
Size

49KB
MD5

0f90642b0b0a71b1a11de53db8b22dc2
SHA1

92d6389d66c0e2950936919a28a32b95e8c2a8a7
SHA256

7293cc1ce0b759ae27249d045c8c258c29f22a4adb35f20e70c221e06c7fe8fe
SHA512

65fc8c26cb513eeaf465208fb4897f47a0336c6005864f866aaafa636fe6d0e9fbf8fe6944cd14789cb1b5db1b2fab81a3b0dc207eb09bd3f3cea71665da4719
SSDEEP

768:u6pnmDJ5ipjXgG0EhrnOE87qydzwMlLDF+KMtR829Ye:uAnCipjXCEhDOFLD8KMtRj

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe
1020	msedge.exe
1020	msedge.exe
4872	identity_helper.exe
4872	identity_helper.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe
4344	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe
1020	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1020 wrote to memory of 1144	1020	msedge.exe	82
PID 1020 wrote to memory of 1144	1020	msedge.exe	82
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 3664	1020	msedge.exe	83
PID 1020 wrote to memory of 2956	1020	msedge.exe	84
PID 1020 wrote to memory of 2956	1020	msedge.exe	84
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85
PID 1020 wrote to memory of 3508	1020	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0f90642b0b0a71b1a11de53db8b22dc2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffadca846f8,0x7ffadca84708,0x7ffadca84718
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2160 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2648 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3140 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3168 /prefetch:1
  2⤵
  PID:544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6692 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6708 /prefetch:1
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2080,3784531243508349131,3836184731776629279,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4344

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000009

Filesize
22KB

MD5
5e74c6d871232d6fe5d88711ece1408b

SHA1
1a5d3ac31e833df4c091f14c94a2ecd1c6294875

SHA256
bcadf445d413314a44375c63418a0f255fbac7afae40be0a80c9231751176105

SHA512
9d001eabce7ffdbf8e338725ef07f0033d0780ea474b7d33c2ad63886ff3578d818eb5c9b130d726353cd813160b49f572736dd288cece84e9bd8b784ce530d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
978e5cae6f4d333157112b5a33bdda6b

SHA1
0db6f7c8f3d62f1c92536b5fd8eab56ed19c4eb9

SHA256
a7a8ec9b12b1dc8edc534c7bd47cc4c224fe796cbdeb9739bd717a89e51d36f3

SHA512
089598ed262e263824735257174e8adc74f4551c36b5d872fe4c04c88f4f5040f58f008adb2c94135c19b337b1612650b56c3e37d6227874ac672d71b778e2de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
5bffebaa2f7ca3a75a5810cb15d396cc

SHA1
c257c0bf2160e89e2bcb443a2219c66865ffc9ba

SHA256
198f83da56b72e47a44682497cebd4b98bc05bceabde03b0831c17a6d1a4130e

SHA512
f9b4efc97a9a7a460c28d0193b6a766fe96f51dee9ba0e52d3a4f29a25f3013e2e0547d030bc6c73f19f55c379a96f2dba34c2c1eada682f4523986c9c8cc9dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9563b6615c7709a13530ae480726837c

SHA1
42e09e0ce2a53464ebafca688df6730b45d1fcf4

SHA256
f6f3a3156824d40919e9e9a9a65d4b0f10a3db0d364da043deca13e1ca5971ad

SHA512
de799032344645a7ac422fb9c7080de0806866fb4fc6ab88a9bf669a49c63cbfcc08348415d08e9ed867a7320cd3b5ee3e285c3390a66c0a4a63f28eb11570fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f9625e6964991901d62781b39cc5d30e

SHA1
5d537b4def7b7d8bc7846476abf85065edf3db17

SHA256
a6270192b7274f5cadbd51d18399eb70a6f4bac9f612377d0040aa3511ac4365

SHA512
81e7f51db9e1ca8b7522318b2c0d3e5060c9712bafdc6f9624d50c7cdac07127a67119c3f6b49685177be74b33ac129132f2482b8d6f62385d97d48e89e6f033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1b55bb4248c7cbff0f5131aa9563b8e9

SHA1
cc5050f901a27469d402fbb0c4e4b12a477de677

SHA256
4fa3e0b02faee77bfe8067b28f17c687065e377237d5a59211ed3a59b23a3275

SHA512
af06de9f10ea94d2a19aef32dd68776318ab21c50f32b24f3c54afe40051e6b56e597304d56534b8f76b3cb86920c6c87277d097ee00d36087ab163dbc32ef32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
18f8d76365bc3391514ba0061c9f8ea0

SHA1
f256c65014c1bde681efd546b7e5d917ba89b0ee

SHA256
91de67c3a2eafff717af83dcf486cecb470245033364ede982abd50dae5827f1

SHA512
5e189f78258b6928e5ca7e0c8a8e6a219bffa1e713b8d085df2ef024cf1c9f152d5775b3513f1a43e55f8be23a9f86f63fe0790add7614719b36ae31bd47b638

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
fcd585a68724c6f803c21217d6349504

SHA1
1ab4f1c7d1ee0d7585e13b0922c94316aff10e04

SHA256
62edfa7fca987e88a83e818e7d9f6f38caad0f5a64ffd115bca7cce2718c8449

SHA512
2dc99b21f812516a2744620ffc251f33dc4cff3a224b9d79f3cdb3d2e758f1e772069a69e21b988f25321c34eca19b86b6e8e9d4837e9d8ff9725236feeca19e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
1cff6092b550651b2d25cf62c806dd86

SHA1
39a6049ee2031ad6fe1f69e52791cbac216be3c3

SHA256
f6b82d3325adfe8179f6a1015eddbb2bf0853d2f7309701450371f0062f667dd

SHA512
3cbcc7a126de2230d52b2059e250dbb71503e10fa462ca0a10987fc988b458338a74544fc57f9b592779cebeb7b296f91326a5dc846223e1c53daa8781b86336

Download Submit