6c200546f0b32d1038d59903a687bd37600834c89ccdcc980a5495e4c353d7d4

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
11/05/2024, 15:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3530518d7245c5e7961f79c2565aeb1d_JaffaCakes118.html
Size

91KB
MD5

3530518d7245c5e7961f79c2565aeb1d
SHA1

de88c723bbc87d31c05f68d1961b9ff6221e0c8a
SHA256

6c200546f0b32d1038d59903a687bd37600834c89ccdcc980a5495e4c353d7d4
SHA512

587e1994df717a9caa817330cbec268eebb9336b7c096f316d256284a0555a3f14207b58ff44ab201850bf6e9dc608b2a88b7a3158698d38f592295652361d21
SSDEEP

1536:8xMLvdKQSJkXg6UdreYLXjcciqdxOiqTqljE5NEnCMydZI:8GLvU6UfLzniqdCYjIMydZI

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4880	msedge.exe
4880	msedge.exe
4060	msedge.exe
4060	msedge.exe
1400	identity_helper.exe
1400	identity_helper.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe
4060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4060 wrote to memory of 2360	4060	msedge.exe	81
PID 4060 wrote to memory of 2360	4060	msedge.exe	81
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 1684	4060	msedge.exe	82
PID 4060 wrote to memory of 4880	4060	msedge.exe	83
PID 4060 wrote to memory of 4880	4060	msedge.exe	83
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84
PID 4060 wrote to memory of 3080	4060	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3530518d7245c5e7961f79c2565aeb1d_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe86fc46f8,0x7ffe86fc4708,0x7ffe86fc4718
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2896 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3316 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5776 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6132 /prefetch:1
  2⤵
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,12938692004488641984,16139954416434605035,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5452 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2888

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ce4c898f8fc7601e2fbc252fdadb5115

SHA1
01bf06badc5da353e539c7c07527d30dccc55a91

SHA256
bce2dfaa91f0d44e977e0f79c60e64954a7b9dc828b0e30fbaa67dbe82f750aa

SHA512
80fff4c722c8d3e69ec4f09510779b7e3518ae60725d2d36903e606a27ec1eaedbdbfac5b662bf2c19194c572ccf0125445f22a907b329ad256e6c00b9cf032c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4158365912175436289496136e7912c2

SHA1
813d11f772b1cfe9ceac2bf37f4f741e5e8fbe59

SHA256
354de4b033ba6e4d85f94d91230cb8501f62e0a4e302cd4076c7e0ad73bedbd1

SHA512
74b4f7b24ad4ea395f3a4cd8dbfae54f112a7c87bce3d286ee5161f6b63d62dfa19bb0d96bb7ed1c6d925f5697a2580c25023d5052c6a09992e6fd9dd49ea82b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000011

Filesize
44KB

MD5
88477d32f888c2b8a3f3d98deb460b3d

SHA1
1fae9ac6c1082fc0426aebe4e683eea9b4ba898c

SHA256
1b1f0b5ef5f21d5742d84f331def7116323365c3dd4aec096a55763e310879d8

SHA512
e0c0588ff27a989cac47797e5a8044983d0b3c75c44416c5f977e0e93e9d3a9321b9283ea077e6dcad0619ac960ee45fe8570f1d5cc7d5d4117fee4f2f0c96b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
300493a70578e33e852ce5565730044b

SHA1
62e90d0af465cfa536f1e4ae866021723dadf584

SHA256
fd7c0cdaadb16c7b291ff576e3b344765ecfc31965dc003ad9c0b3afb1ee3554

SHA512
c136b29b25db3c4b881ecc83e668bf10dd3323821d099cf4ec8a2727a8f4271816dd5f30aba7a2597902025c5abeff6fdb7429bf510ed503e1526153bd53e3cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
6bb0cef4c9cb48ebcf59c8fa157e4763

SHA1
3c19ba599cb76b00e324909c70bcf449a117dee7

SHA256
95d32c55ec7abff20674d7230d0128e259ce9065081f60fed7ccadf2369003c5

SHA512
72cedcc3f8d08049a989c02e078aa080acd15ec1c9172b3c73b8661ac30e3ff04d05205086bd4db1caf3b830e8843e7e802686a791855f58a2186a0de232b033

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bc8e0fbbd0c5e119fd291af9fb2ca43b

SHA1
477e00a4be609bf2c94b743a75e33599271fb76c

SHA256
007f7ef03e8f2015e83fb3a6231e83010ad3397ab45f71ce6db8b6946efc0019

SHA512
191c607cd3d941133d83a55197efb67276586d03b1fd88b9a8763d7a10831dde1f543e0db562c0517ec49ab875fd5c331615424b69ad235ca2fc0b4e940c783d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
58ef74d40397fe7f2c3264d9bf1def13

SHA1
b4e27e74f34aff16eb18ef0c12c6e929c18b4bcf

SHA256
aa3bbd104e69a65538c368b1380bbe04c9d12dcbb44748dbce1bf08bd17579e9

SHA512
2988fd9f6d135c3b3fa610f1a6ecede308d4c38581f26a28431a9b42057bea2dd22e8864523d6cf7e6dfe20b2d45223b817ac4f513e4129ff62a5a8969b2e4b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b1a338fea79386e156be3c85152875a5

SHA1
2536b37cd40bcb66d4489f38758f9b1a8631634a

SHA256
a0a66e9fbee3aa7603d3e85036ca5e3c9bfef8d5bb714b5ebdd34ae80beab9e8

SHA512
ab6606fcaf0421da80c8143852004e960b0aac254e3fe210ae519af799645c457e976d54b82c04316920e93a9fb95061793497428137c7ebc175ffcde6557c7c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
0be24f3b7aa0bcba9812a5acc026ae4c

SHA1
b2c437dee7131f9e08046ec0ccd83354c2e542a7

SHA256
e98d338f576aaf5f6b0cdab6240ab452cbbb1ab6676389eb5ee04b28b67ff156

SHA512
a4c283fc11b1acdafa680501c4e127bee3c28736607f5957f3acb3ef32c4c731431808bfb21b4dc62e9031eda84936318e96ccaa7f1fee07cf41c721e4ebf6d9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
9dfb67f305a42831cdfe3832b1989d65

SHA1
6a1fbd5e70d36fbe0eda887d6b73d5d3080f6ab2

SHA256
3dc8710ae40c7ba143c2c37701c2e426e670294250d28a3017b91914d4c4717b

SHA512
b6af5d2a3e3793d49aa919e888b0da3560604917d04a0c5a7f5c5b67358a965d581d2cfd7722a54fa6d8ea850c59aafd5e2796e4d297b5c77190174eee0b0fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
13fe6fb8fa5ced6fc7e19a5073e808eb

SHA1
a5b4c4d724e317602906c2b99b21ad43e00d82f1

SHA256
67635bcb1f05c7d332ca46144169a823d51c7af5b94eec1f4f032cf4e0df6c47

SHA512
21923821cccb7de026104ba08dbac796ec0c42fdfe02a77709e30e14637d33e1a863d9f83eb78bda23742d7c3c6917662eada76ea9ec220b5e6ca4a6177ee27c

Download Submit