02732a065c8bf67652bfc28ff9267fe16b00f502af2dab0b9b805da9e07ea442

Analysis

max time kernel
145s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
04/06/2024, 19:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9614791483ba6b221ee6b4b6d246dbf0_JaffaCakes118.html
Size

26KB
MD5

9614791483ba6b221ee6b4b6d246dbf0
SHA1

80daa520998bb98e2417ccbe3b49865bfb347ec5
SHA256

02732a065c8bf67652bfc28ff9267fe16b00f502af2dab0b9b805da9e07ea442
SHA512

7bb7657084659cef372791802b6cc477259ac0e6b56d5255069dae2139670addcfd2d30c451912fa5ad4cd7929ef925a73f46b195c920cb06bb601ffa62e0fdd
SSDEEP

768:U+koQs0YvWl75uMftpJfFhhfrJizhm4QosysVh:U+RQs0YvWl75uMfrJfFhdrWhAysVh

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
540	msedge.exe
540	msedge.exe
3632	msedge.exe
3632	msedge.exe
2212	identity_helper.exe
2212	identity_helper.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe
864	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3540	3632	msedge.exe	82
PID 3632 wrote to memory of 3540	3632	msedge.exe	82
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 1104	3632	msedge.exe	83
PID 3632 wrote to memory of 540	3632	msedge.exe	84
PID 3632 wrote to memory of 540	3632	msedge.exe	84
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85
PID 3632 wrote to memory of 2628	3632	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\9614791483ba6b221ee6b4b6d246dbf0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc0b3546f8,0x7ffc0b354708,0x7ffc0b354718
  2⤵
  PID:3540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2156 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2856 /prefetch:8
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2836 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5640 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7160 /prefetch:1
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2668 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6848 /prefetch:1
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4036 /prefetch:1
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7092 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2092,5198726660275071874,13840999393963656267,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:864

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2944

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4b4f91fa1b362ba5341ecb2836438dea

SHA1
9561f5aabed742404d455da735259a2c6781fa07

SHA256
d824b742eace197ddc8b6ed5d918f390fde4b0fbf0e371b8e1f2ed40a3b6455c

SHA512
fef22217dcdd8000bc193e25129699d4b8f7a103ca4fe1613baf73ccf67090d9fbae27eb93e4bb8747455853a0a4326f2d0c38df41c8d42351cdcd4132418dac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eaa3db555ab5bc0cb364826204aad3f0

SHA1
a4cdfaac8de49e6e6e88b335cfeaa7c9e3c563ca

SHA256
ef7baeb1b2ab05ff3c5fbb76c2759db49294654548706c7c8e87f0cde855b86b

SHA512
e13981da51b52c15261ecabb98af32f9b920651b46b10ce0cc823c5878b22eb1420258c80deef204070d1e0bdd3a64d875ac2522e3713a3cf11657aa55aeccd4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
288B

MD5
63591cf409f999be0a25f845f91df798

SHA1
30bcd6c5eca2570c11feca59b98f13d372572dff

SHA256
d8b52bcf399d1d245f0f420ce6cab577e495fbe07079563501f955d610a5414d

SHA512
f24bf3ca4f2d4716fb029951806e4b6cd414a9b15d645cface6499cb7d11749fb34047b36b1855e0af19f8ebc5901e237968ec0a731b9141266cd68a2c6321df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
42a8659f56ccc69434e1662351895d6b

SHA1
9a5fdd294e6f4d1423f68f830d172033fc77921d

SHA256
86b4c2c0b3004aba876162c6c4b899088254a88e001a120d6d9b96271884574c

SHA512
48842ff6237ac0bf6d6ca0416c6a6fd11f25caa824e4cf98ce2b7772b4f19edd6332ddb1ec33ec86354930b534e8a181014bc347b232d3214d61dd4565b25473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9c0f9b2aa7a89e6eecd805a6ba96b9da

SHA1
6c7e6092f7e1dd29023e07734d6038e18d202eda

SHA256
b5c8491c1e68163d79ffe7d72c84e4090e3814bd55fb0a6e36a3bf072ad858f3

SHA512
dfb15d9d56bef712cb62374a16c5ec3023247ffd2844dd08645542d8826024867f6e1fee12c11f132d227f97dd79cbe1b3ef1879f20de278a78a9667616ca746

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
3401c4c750ec4334943832b76ae3a229

SHA1
fb8d01567c491e9ccb9f47132cb114f553ca5e7b

SHA256
5b7e0687167accf68cf591d4ef4497f319bc1d89fd7786f409b6263e47945dbc

SHA512
175762b90f4af9a7dde9d5d0baf83d4b2f9a1e20144e7ff23ffa2b5c95ce6ba35b71c7672d34eb55984ee8769e0afc3457d22362f9b72ee220af24ac3dc2a86d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
13888d271f54ed77bc4bbac39f9af7b4

SHA1
c89f9d625876aaa5559f0d04b9a4b29265c844d0

SHA256
a51bdba2340b1197a599f3a2fd6aa55185dd2465f697c82356a7a994847a5692

SHA512
533a0aef8092dae980fc443aa4a5a3eee0b0d21d6a4f19d375650c77900cc965e1e23666a7763a0b2cd836f902f99029b7c788f6f3675d23616738efef3a2f8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
73ac93f2114f5b34f286f2b5751e02c6

SHA1
c3053c4636dce2a772a29d5c3131844a694f6016

SHA256
e001c98fc2096a2ec1c5650d34d9653257619ee24fc1905e00c1393c9df13b7c

SHA512
22ee3b5976c5b5982c170b82099483fa96f65c3c0d4858e2861ca06d3c5c1a586d6453b41caafa57b5a8f666637302dc7bd0f7b813aa9fafe193f9dd2d077d6e

Download Submit