1406e097062eb7b44f2d38993a93bc616b55e0e626a356fee374d5a0df8fbf82

Analysis

max time kernel
145s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
03-07-2024 18:36

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

235b9a014531f84d1a758c8571d0ad29_JaffaCakes118.html
Size

57KB
MD5

235b9a014531f84d1a758c8571d0ad29
SHA1

92b9a18af44c8af45f60b85d4ca58acbddc2297f
SHA256

1406e097062eb7b44f2d38993a93bc616b55e0e626a356fee374d5a0df8fbf82
SHA512

cc5ea4750987f3a15945c89d41f08088e4e8b52ba06af9fc4ab5000c64f83e160a5110b5fb3863b29a75d98d051f1e4252ff3bd0cf0febcad4a2dd05c99ee36f
SSDEEP

1536:ijEQvK8OPHdFA1o2vgyHJv0owbd6zKD6CDK2RVroRiwpDK2RVy:ijnOPHdFN2vgyHJutDK2RVroRiwpDK2m

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4460	msedge.exe
4460	msedge.exe
2272	msedge.exe
2272	msedge.exe
2608	identity_helper.exe
2608	identity_helper.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe
1116	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2272 wrote to memory of 2808	2272	msedge.exe	80
PID 2272 wrote to memory of 2808	2272	msedge.exe	80
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 2124	2272	msedge.exe	81
PID 2272 wrote to memory of 4460	2272	msedge.exe	82
PID 2272 wrote to memory of 4460	2272	msedge.exe	82
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83
PID 2272 wrote to memory of 3344	2272	msedge.exe	83

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\235b9a014531f84d1a758c8571d0ad29_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8c04046f8,0x7ff8c0404708,0x7ff8c0404718
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2440 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2820 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:3532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3248 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:1284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6620 /prefetch:1
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6536 /prefetch:1
  2⤵
  PID:776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6340 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6676 /prefetch:1
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2140,3023679205651177588,5820034042870215222,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3764 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1116

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2100

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a8e767fd33edd97d306efb6905f93252

SHA1
a6f80ace2b57599f64b0ae3c7381f34e9456f9d3

SHA256
c8077a9fc79e2691ef321d556c4ce9933ca0570f2bbaa32fa32999dfd5f908bb

SHA512
07b748582fe222795bce74919aa06e9a09025c14493edb6f3b1f112d9a97ac2225fe0904cac9adf2a62c98c42f7877076e409803014f0afd395f4cc8be207241

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
439b5e04ca18c7fb02cf406e6eb24167

SHA1
e0c5bb6216903934726e3570b7d63295b9d28987

SHA256
247d0658695a1eb44924a32363906e37e9864ba742fe35362a71f3a520ad2654

SHA512
d0241e397060eebd4535197de4f1ae925aa88ae413a3a9ded6e856b356c4324dfd45dddfef9a536f04e4a258e8fe5dc1586d92d1d56b649f75ded8eddeb1f3e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
696B

MD5
ea5f26374fa3a817f7bdae8a29e488cd

SHA1
8efce9ffabe652d6b20de1561ca009462f98330b

SHA256
cebc684d884fa2937fef9e4fec683522ec5b4322cd24f80f353959475f3b4b9f

SHA512
d61ae1026828b17c10af6971e975dcb8e40a914d268ada99975bc40fffe8e623655dc5b80331f9708f615e8b96dc6dd3b84b4fb663b05ca865c9331b586acabe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7d62a9523145407a0f37c4e119a2491d

SHA1
8c48061304efb65fdbadd2778f76e620627b5a16

SHA256
9a85b4d4e0acf95807aa8d1e516f50c2fd29fa648d26465c175d84111159f67c

SHA512
216348f509e6fe024b74b62bd84c3aa60518bef4223c89d78d76233dfc710e51a8f266b73ce18a9ba3679ac6267a5e2331f965e3bd0d831e3fe02c698c2ee2fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
44a7f28898a7314256d877002169d886

SHA1
36e565014c8556a50a0dcc93f26bf7fe90b790c4

SHA256
1239c2e16a6034e529901cfb09d193e355f87885456819b8c47da3f1cffa0469

SHA512
531f0e5d48681c2c3aeba0575c79c65d02ac4a2a7660da69467c141dbe99645def27f334b13f81fb1e4b1bc20c221597fefb50ddb16c39e63e79adba2ca71ab1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
328245742e3d7451a488c4673fd8699a

SHA1
92b26fc3c2535ffcfeee0399c74d1b0961730c1e

SHA256
813379c612ee448b3e0527ba7f750661de6a41dd2f8c752c17c195836e75f364

SHA512
56d76e34579b3f59c8cc3cfcf9527edf8526a925b0cbb779d9165a4ae6d4b109d648f6d63bbd03b7d9500fe6d0ff598ca8ca2f2c87716b30fd9e235aba5949bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9cab083dbc95cf6cd3feb7b30fcd230b

SHA1
0eb76071ad1e1483913f583b1ef1d56b48c200c2

SHA256
56f9e206b3ebfed32d969b285ea5b30433fdc889d7a9826130118cdfcee9a06c

SHA512
90af703ecc0834024a56e9469269e8c3b2d7f7b94a8466afc0db789ec541ad9ccef4807abbdc754b465a413bdc033e843b1d072a5f26841b9954090a48d2f5b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1fcd763ab2e4dae9d48185c5b758b85e

SHA1
64e346f61f834eae9222890d98ccc194a5801649

SHA256
8de841e8cd4a562b6b7e7fc6b95478fd500a18e700f2bc1e8606ecd5037f6790

SHA512
a2d77207fe08911469267b5887ac6841ad0e6c11df1f8e95e28fbfb2b44fb62d16abf915f6c8c7f846064e73b7beaf2b0e9c6f6c054f59ff2e95d8e098f139e8

Download Submit