ebea25a1057eaf851c0ce6e3aea44b5f20095563c210a62ee04e2b9023d9a13c

Analysis

max time kernel
135s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240419-en
resource tags

arch:x64arch:x86image:win10v2004-20240419-enlocale:en-usos:windows10-2004-x64system
submitted
04/05/2024, 15:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1366931e29667cde7577eee25c9567b6_JaffaCakes118.html
Size

87KB
MD5

1366931e29667cde7577eee25c9567b6
SHA1

8943694d969ecc84c2068430947fafe2dd717dfb
SHA256

ebea25a1057eaf851c0ce6e3aea44b5f20095563c210a62ee04e2b9023d9a13c
SHA512

8fee8787c36e65e4b2e9a892df05d3299f8ae3955446ce4493b3c8fb0d498221904721664bd5e5065332849461636c43b7629157939a6df0117c32b57fd4a21c
SSDEEP

1536:ski8P/JoAoG0xRWtnqn0vMcc5deUcvt7D8VcwMIGFMxFo6UPBstJnhbd1ZqW1Hj7:ski8PBoyMGhvt8VkIGFMxFo6UPBstJnz

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4120	msedge.exe
4120	msedge.exe
3116	msedge.exe
3116	msedge.exe
5700	identity_helper.exe
5700	identity_helper.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe
2692	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe
3116	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4040	3116	msedge.exe	85
PID 3116 wrote to memory of 4040	3116	msedge.exe	85
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4024	3116	msedge.exe	86
PID 3116 wrote to memory of 4120	3116	msedge.exe	87
PID 3116 wrote to memory of 4120	3116	msedge.exe	87
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88
PID 3116 wrote to memory of 3796	3116	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1366931e29667cde7577eee25c9567b6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc923546f8,0x7ffc92354708,0x7ffc92354718
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2076 /prefetch:2
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5220 /prefetch:1
  2⤵
  PID:952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5464 /prefetch:1
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5636 /prefetch:1
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5656 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2704 /prefetch:1
  2⤵
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7016 /prefetch:1
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6440 /prefetch:1
  2⤵
  PID:5772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,8992015184460839093,4901941430924717723,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2264

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2a70f1bd4da893a67660d6432970788d

SHA1
ddf4047e0d468f56ea0c0d8ff078a86a0bb62873

SHA256
c550af5ba51f68ac4d18747edc5dea1a655dd212d84bad1e6168ba7a97745561

SHA512
26b9a365e77df032fc5c461d85d1ba313eafead38827190608c6537ec12b2dfdbed4e1705bfd1e61899034791ad6fa88ea7490c3a48cdaec4d04cd0577b11343

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
fbe1ce4d182aaffb80de94263be1dd35

SHA1
bc6c9827aa35a136a7d79be9e606ff359e2ac3ea

SHA256
0021f72dbca789f179762b0e17c28fe0b93a12539b08294800e47469905aeb51

SHA512
3fb0a3b38e7d4a30f5560594b1d14e6e58419e274255fb68dfe0ca897aa181f9ce8cb2048403f851fd36a17b0e34d272d03927769d41a500b2fe64806354902f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
40KB

MD5
5c6915af5fc1a2f3ade5d21d864d650a

SHA1
7459091b99d32474141b9a324bed7c2831353d5b

SHA256
1c0c57ffa35d64b3606683725c13ae67e58456253e99030e444d6bbd46d6d698

SHA512
ca59484c79701a9e1c7c57d1c6047eb79c746354c081f6a19bcdac9479626255e09b9b357d9d1cac830c386ea32443cf677b2964bed8b2a55e3670bcf7ddb16a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
8c010c709a7e3bfa1ae684446e360760

SHA1
2bcd08f18a77013db2ce9864e2eeccf814dda934

SHA256
287bcedff1cf1d2a05e57a178535e4d346f6e8c31b4e731dbb087256ddf161da

SHA512
4d008315a053f5a4dfc93639cf3acf0c1a84a8251d875f125ae60c3a9a1dafe9b3bcf20273ee047dec58f8c5c82a837856346647b14d59fdf42a5b94d07934da

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
a5d20ef7bb58bf241a8b56df8961c6fb

SHA1
715485b837dba9feac795c6f7afedc0ff7e9c0a6

SHA256
56d82d1ce3e3588fe41a6f209eae0cb2744325fe46ab4a910b707e18d18f8ac5

SHA512
8d4d204f6447cb954bf040c06ecaa75bc6c169854dd1b5748cfe4bca28b31b163169de2df2956e148545648507d059215798d7e7e461a5f46fc17c6c9281c252

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
f032d2809e48307c0bb245b93ca3b322

SHA1
ef89ccfe3c6614e10b4e004ed728e9793fa25359

SHA256
66e47a798d81531095214d521be34b0f96b3d5ee0735a2b49fec899c0ee529d4

SHA512
6facbd6fccbff12f44364ad1e9bb40803ba2bbadc54da6b7ccff65d831e64cb1e66ae79dedcfdff6a6882040b88fa92ede04dfab52b382d746bd2414170ea2c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
87bd096fcde88a927b76d545ea1777ac

SHA1
75e536835be2188f123d39587b123a66383c7378

SHA256
4c239262918dc8dcfdd1292dd925116acbdbc27b38aa6a96a8aa6918e6266f4d

SHA512
a6482ec5d99945a702029a28e6f463e68f67e7b448f5fab390a28e70a3552aa622fb366a8b223914c23ca737c8e2ecfe79275d5442ef0416f24c7fe79d8935e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
b84c989236022a2189de1139b57df8ce

SHA1
b059f3d5b9622033aa1dec468d5454070651c295

SHA256
6f049c1ae986f9f590758807ec2f795cbb9f6162c8ac8f3e105f7f4feceb78cb

SHA512
2e926347dc51ed1b07dcaef1e11ab492ebf77396fc650133417f27c6bc6801cfefd817b8d7f3fce403f0aa52ea35d1c59e736257e335de458a6d8d5dd083c4af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
2486021ca3fb847bb136334805ae39b2

SHA1
3d6102c96b14879f2810b93eba1d2f2a84ad1657

SHA256
4099e23f1fda06b5d8519954d92b8c91dc27029e986f95fba71eb23f830cb98e

SHA512
ab05b5cfe5ff225bfca70a20162211b6c52539377109a0e62196bfc5f161a1f4fa2c7031cc878155b70ef631f38b17fc812d2af0ea8344aab4e0baf4ed59755d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
bf7338b6b3b1a537954f11b8f5c9b680

SHA1
59bc86c11c7c22916d35680097b5a37d124e4a99

SHA256
262e2d1d11bb0f300488c295ec2c39510a9b732fd28227ded733ea08373bbb5a

SHA512
4bb7a46ad9117607ae0749f1eb9d548455e2b91429656bd479c65ef9bae449a25f7d7e9526f35b8344ccc0095db2ca273e28e80ff3b1a554b2606922e5733042

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
772bac820c1967a6631037cf35a92558

SHA1
aa1f8360d74ab09ed7995858282c65f545e39b5a

SHA256
d2d34293cf277f7892a473302ce22a14be31eade8aad84794120efa318a42b83

SHA512
411ba848256c3abe00090ce65a3e650feba120f37332bddb97e750b6b4e8e54eec930ba83a851a06a6ef4eb28a044a09d199275d18c5b68a29dc8b68b456311c

Download Submit