92f022d09b9f629dc1d0698e82232950d1f2d0d0d94b690c51622ab07b194290

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
12-08-2024 11:28

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8e90d9139d800895a03c800e1349574b_JaffaCakes118.html
Size

155KB
MD5

8e90d9139d800895a03c800e1349574b
SHA1

c8e02a6a191807ced3a934f17449aec3a3ada264
SHA256

92f022d09b9f629dc1d0698e82232950d1f2d0d0d94b690c51622ab07b194290
SHA512

189435629ed74ebd19e7c14d580b9f4ec369d6783d8ec5c487565e0e77892742fb5808040a38585da2b2d1ed09d4336fc6d332ac2bb8b8b6cf47d1d484bc465a
SSDEEP

3072:t24EijZeqLVEijZeqL+btV9b2JfgqrRz5yDQ10uMT+5XgZYXqNCG9RpNO6jtGa+W:o4EijZeqLVEijZeqL3JfipWaUm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2356	msedge.exe
2356	msedge.exe
1816	msedge.exe
1816	msedge.exe
3800	identity_helper.exe
3800	identity_helper.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe
4232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe
1816	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3264	1816	msedge.exe	86
PID 1816 wrote to memory of 3264	1816	msedge.exe	86
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 1796	1816	msedge.exe	87
PID 1816 wrote to memory of 2356	1816	msedge.exe	88
PID 1816 wrote to memory of 2356	1816	msedge.exe	88
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89
PID 1816 wrote to memory of 4588	1816	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8e90d9139d800895a03c800e1349574b_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd582646f8,0x7ffd58264708,0x7ffd58264718
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:1904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5052 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:2160
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1348 /prefetch:8
  2⤵
  PID:1196
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1348 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3736 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1856 /prefetch:1
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,3733001309340173652,16742086647395255356,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5984 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4232

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2368

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000012

Filesize
21KB

MD5
c3a1bf5fbff5530f55ad9f9fa464f25c

SHA1
449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa

SHA256
4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0

SHA512
75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
b90ff133cd0cc90fbab4fc93521dfc66

SHA1
9dc8691e82393dbc6056b13611a76a349e75eead

SHA256
bfbfa047874b424a19cc92ef318b93d46b0f731e9ab5018fc8bb323602bdd6cc

SHA512
ef53dd815a8d8bb82dc9520124b35b9afc3c821bd93e9417f7e29e508d0a555f705e2b4262b92a6bad43b336a312fb160cdbbf4abef110305e96b7470692a9e2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
c7ce3d3d7a1b83656be150ef1c6f08fc

SHA1
f21a8f4b4dad13b4ec042f9a112afe7b5d358de1

SHA256
9bc36a218789718db582b90d94a6dc9f12c67b97bb9b71f78acab90f1d87e46e

SHA512
d28f53d7ba227cdf63ce07bace13b46f10de61ad2d048b98206ca5cc5fa4368e3b694acfd62e938b1fcc48d679337802ffe2c8cc3709ad98c7fa122f8679a4b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
4KB

MD5
13dfb453be4e7cbfe0ceb1c520bd83d5

SHA1
640a985f92288575ff0da2f58dd4ab277c5fac77

SHA256
0ced91ee5494e2be7a7660b564e12ea6c32020ae5cf6807f0f2f1ceac80c4c0f

SHA512
ac87a27c534f64026d15d5cc445f4fe4fcbadc5f81e11da3addd2f8ebe0b3103e7b3024e6ebaca537061c945c0a1b4c90e23bc27ffd589167860be5a38486555

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8ed716d48f4d80b822588147381f7aed

SHA1
4299e7aadc7e51ae2884b24a5234863447c12325

SHA256
0ba447a2f5f8ad4f448a1410bfb5c257626feaf42cc49b42ec62f62e633a988e

SHA512
5bc8a66b7b98c3a55e4dcc95ce43d4b5cde44eec49aae6f1bedfd2f31afe73343d68ca249549667adcf75b32dfd68a556b21563ba1d311df52b3d3c16e8e37ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
4268801c20c134fe7a4045cbf4911403

SHA1
662f475d853d6c189d13cf9e7c3ef750666229b4

SHA256
52c093107a6d287b1f40750a04ce0bcb42aa99f67c337c4d75ddf347a864b63b

SHA512
acfae7df0b076a60d56f4cb3db2c52dff735c495b263c7207b86b84cf7034444d53b55f56cad239c1c927c62d1c91b48c8ede476f44c869d757c0df6d5ba1d06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
344d74273d465032a0501e7659b54448

SHA1
90398ffd803b235849cf08baa61c44a2e0338cc9

SHA256
c9c044c5691edae029a27f7ce7f5d505637359e0eeb460e18939e6b9e62de7b8

SHA512
3cfdddb465d221b215e598fb1facd892a0935cc154745c05905903029b6f9fae293173c15da49e143146379e4792f1f3ee3f6424a89385b91f547d2341f6aae3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
9b3640bdb43444a9609fe50ad5a9f28c

SHA1
c0abea4e63f230bc676c912a14e0fcf2dcc8fdcf

SHA256
bc1f9d83a94fe800c094e361bb22f468dbbb35f01fd7491281227243c139d308

SHA512
08429ab9a3e42ccfefe4f41615a9c9a283cf98c3851a765929ec2e4ef47d8ed945fd0434388eaaff531e53b6c57f14485edfc65666e277443c3142957ac9a9e9

Download Submit