3e35887606480b0153da00391a972f6e7e379f1a719785f3479518830c6ae2be

Analysis

max time kernel
145s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
01-06-2024 23:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8c19d47842378046fce257a00e51e6e3_JaffaCakes118.html
Size

42KB
MD5

8c19d47842378046fce257a00e51e6e3
SHA1

79ad6a724384b73bd5d0c3f8527cc97cd1e69169
SHA256

3e35887606480b0153da00391a972f6e7e379f1a719785f3479518830c6ae2be
SHA512

f558f59e0d6d001b15fbbb281a95bac710aa510a1f47c71efc2091d9951151f816558240c4ffb814a8f7901d6c11a5c4e0369eab398ee69fa3f844bf47cdbd03
SSDEEP

768:vakpttA0KywWwMQ5VZ6ObhTibayVq6y6GXZONcQQp0PQ2PWYH/5jWwPVI:vakJA0KywMQww6y6AENcQQp0PDPBH/5Q

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3440	msedge.exe
3440	msedge.exe
1612	msedge.exe
1612	msedge.exe
5012	identity_helper.exe
5012	identity_helper.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe
3636	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe
1612	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1612 wrote to memory of 4376	1612	msedge.exe	83
PID 1612 wrote to memory of 4376	1612	msedge.exe	83
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3084	1612	msedge.exe	84
PID 1612 wrote to memory of 3440	1612	msedge.exe	85
PID 1612 wrote to memory of 3440	1612	msedge.exe	85
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86
PID 1612 wrote to memory of 620	1612	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8c19d47842378046fce257a00e51e6e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff871a346f8,0x7ff871a34708,0x7ff871a34718
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2848 /prefetch:8
  2⤵
  PID:620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2720 /prefetch:1
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6000 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2032,4759941496465619413,5165686699990257658,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5864 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3636

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3332

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\1d8be137-ae01-42d3-9c0e-d1c291a08a8c.tmp

Filesize
10KB

MD5
88807d6c102db0436d583a12faac4504

SHA1
95d059686ed8b82d12b100b556f634931e39fb11

SHA256
9be0d8dc03f7efe9cbf1a2e45906d204c6a7cae6f719a29b102644ee7a6e3067

SHA512
a50ab5dd37672b55afd1d40d504e44057c1f807207fca1109d086a9c27acfd0bc89d799c32c8fb661090462e690240a8ddb64280a3736fcb77e3d10ad1d26eec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
537815e7cc5c694912ac0308147852e4

SHA1
2ccdd9d9dc637db5462fe8119c0df261146c363c

SHA256
b4b69d099507d88abdeff4835e06cc6711e1c47464c963d013cef0a278e52d4f

SHA512
63969a69af057235dbdecddc483ef5ce0058673179a3580c5aa12938c9501513cdb72dd703a06fa7d4fc08d074f17528283338c795334398497c771ecbd1350a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8b167567021ccb1a9fdf073fa9112ef0

SHA1
3baf293fbfaa7c1e7cdacb5f2975737f4ef69898

SHA256
26764cedf35f118b55f30b3a36e0693f9f38290a5b2b6b8b83a00e990ae18513

SHA512
726098001ef1acf1dd154a658752fa27dea32bca8fbb66395c142cb666102e71632adbad1b7e2f717071cd3e3af3867471932a71707f2ae97b989f4be468ab54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
23KB

MD5
e1c71f7c04be834f5587230db2ad24b3

SHA1
f3bab9cb99d9f343bf7ed3981aaa7450515d2424

SHA256
9fb6c768068467b58cc773a3907f3f5ec170bfe02ca8f301f6a232a9daf5a899

SHA512
205366b4a3ca0dae58722a19ba24088dd8db483db9d14b376434024b064715ade720347ff5de87db014e32d2ef8192e71bbbdd3c885d5a8581b4aafc6e88ce51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
201a5e77803a111841d222752205adab

SHA1
2115de466db18d51798a2fcb22e1d284b8f9528a

SHA256
1bbd49de7dbc3b8deb66265c205703842c4ff5594a9b3a4dedf68717fb4a4caf

SHA512
39eb8ba183e5e845438fd6d0a5495a47ac1c24ac89e486d5ef2fe363df076623bc6b5a9c4ca3f07b3970e59907667ddf83c0f8dfb5c95395b1c7a58a0db92e72

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
44f8010205d84ff04bdfe748cf8cca0d

SHA1
9d1c4e138d61887a4e26acafe334274414577002

SHA256
c356f1a74cf18985f2d2742fedbaa5561188cc353999160d7cc4bc4bbdce06c1

SHA512
27f4643ed78c7a08835d77c84b337e38073e4d3eca74ab5029d6ceb2343d591becc4636c495ce32d8025f3a66a6c641f4cdcc6b9a09ceb1627ef7b0d2df20120

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
84c5e0d6cd13cd63ed066d776f137828

SHA1
b3e9d6e3c335d8a1b7d37bcfde0dd7c8389c0444

SHA256
23ac8a6eed5700fd89cd274b860897b95b344b8b80425633913c06c0ec6e30b4

SHA512
bd5ac14a175cb89b3706c4a423b48c4ecc818424b27369ca340a078ed0fd795114942b59cc4f88f81f723d4893b45e0a6e83dc7a470fd073d84151e0ac8f5278

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
10dd1800222a8514becb2d56ce7f7cda

SHA1
46d1f61340a38b51cec9d7a3265dd3e8fb2cc659

SHA256
301fbeda1698efdcb5763416ac4f87f78445f699336627802018342ed6575384

SHA512
9843af0b40b926193f99bc9ccac04ce904b334186c111bc9a803e2da5df31c4d6ee664c7cc3421157882f98f5a52366aaf754e82c53e32842dbe825b36fb9bb2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8343d639d96deaf4c7213ae0536d39e2

SHA1
ba6014c9ec8c4caa357b33a83ae46ca40c90f7a3

SHA256
f55bc0f5a7c85c95b31ddd8f877923d18e7e4349b1673abca307e53e6d12580e

SHA512
16dea33aed0942557aebe8b618ce76194a9751643f99381c1ceda759c13ca89b0f802ad5bec8a2d638c21f458a0f0d7efacc1f548f5645e309ec2990c24ab35a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a656dc1e48a1f08f2fd9c652891f005b

SHA1
01628b147ea5d5b56cc6d91ea3709b5cb6a4d8b0

SHA256
ead8df7c0a8a5d4e75c8f3bd35437a3f29801c270bbe15b31436e6b0f52d16a7

SHA512
9e491efd1cb5091fc51b0225ea651d91123af5183005c004a480a66d3deda168620614a4576f715d81caa93ab337ee332d21d99334670e0e24b11bd59a6e9d5d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
28390e2fca1b1e4851d7aa6db4d386c5

SHA1
d88110fe63d73ddb9f3ad8e166d6df7d9bf0be9b

SHA256
22c35a102457f2057d5cfd239166b504b39ca39f9d52630942948d187d8ba1ea

SHA512
b6e326041afec26d9cd2f6a0448ea3aa4cc122043a27bdaf6da83248c40dd075b94c651e944a90dea5cfe403b25525b161332c27d4845cd9b2c0a7a963f1bd9c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit