9370b04fa84853254c0665ebda5852b5c6fbdf2f1646a43f52fe41b836d25822

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

adca707af45ba7a0a2aa2e501048b683_JaffaCakes118.html
Size

57KB
MD5

adca707af45ba7a0a2aa2e501048b683
SHA1

3815f3ff01a037c55277c48e850ebf7ece68ac76
SHA256

9370b04fa84853254c0665ebda5852b5c6fbdf2f1646a43f52fe41b836d25822
SHA512

4fa2e42acd75378b6b62889715e67e46843c74f5396263c6427e58bb045715659b623891fee29d5790e27f0388d7f32b2083390b055445ea65d7c94aa96ee093
SSDEEP

1536:ijEQvK8OPHdVABo2vgyHJv0owbd6zKD6CDK2RVro99wpDK2RVy:ijnOPHdVF2vgyHJutDK2RVro99wpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1128	msedge.exe
1128	msedge.exe
3344	msedge.exe
3344	msedge.exe
4600	identity_helper.exe
4600	identity_helper.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe
1496	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe
3344	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3344 wrote to memory of 3176	3344	msedge.exe	84
PID 3344 wrote to memory of 3176	3344	msedge.exe	84
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 3524	3344	msedge.exe	85
PID 3344 wrote to memory of 1128	3344	msedge.exe	86
PID 3344 wrote to memory of 1128	3344	msedge.exe	86
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87
PID 3344 wrote to memory of 1172	3344	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\adca707af45ba7a0a2aa2e501048b683_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9991f46f8,0x7ff9991f4708,0x7ff9991f4718
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2144 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3192 /prefetch:1
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3284 /prefetch:1
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4680 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4828 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5532 /prefetch:1
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3332 /prefetch:1
  2⤵
  PID:2592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6316 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6508 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5972 /prefetch:1
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5660 /prefetch:1
  2⤵
  PID:5344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,11287842645144172925,661363148220302113,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1292 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1496

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3012

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3824

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
7efccedb45ca76f96eb1a1b5fb25e962

SHA1
7df00c734e88a3fd2081cb089271b62e3c4b1fbe

SHA256
dca7f9d159f5310d5f7aa4643a08a5d801fab648b8dbb4096ad3e235e2bf39f0

SHA512
19ff0a88aaea0c9ca856a1bb2c03308e527d9b1db9f7375a7e9c0fd425eb09ab03533ab479d933168462ade9304868ec8b159f80d85c12aad1fbe8bbbf861b3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
840B

MD5
aa1c07bb250057135fb88e0d6aa6ec71

SHA1
9a6436a5c7125ad146a4dcdad4263f210fa9a7db

SHA256
c711f223bf14182de0836b74f48164d7acf2dbce9f07c5d8c2a2184bcc0b8a98

SHA512
cda740020d58419e27b0d20c1b0248ce140aec89bfcc8f9fbdd5f550dd3d05a731fdf9ffffa7541bf02fdcb68d3b6d418e77a9cc41fb7e72144e6b914588007f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
9ba018bea4d6b8b79d902bd9df6900d9

SHA1
fd551f95fdc333eacecb91af4204b5a25238d9c8

SHA256
9e2936be86c7661ab8a570a8be1e27c786817de1d884e2e5a5d3a0aad9110de3

SHA512
27ee796ce99e17ee81f5c7a0ba7177cd5c3e5ddc17674b8172ae9e0fb2bcfa04428b594d8fb20206cf315d11573c54e324e4b18bc2c579ceedf62dcdc5a2951d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2c917480110bfb8ad05481035fce8429

SHA1
d40184f0bf76c2472673a466adecef12e021f881

SHA256
e68d76dec4b12b8f97c4e41d35c7d5c98b5074b26cebff14ea9047e48c1e8231

SHA512
45158b046b60a475f9fe28192573cc11d0ceb968513edb71834b08ec36d96a6356620f03f2eecde21925b4b837903e4a84ff2cd8c5527287fa10fca25419e6b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f7e4cdc17f546cb1907c8ac653ea47db

SHA1
63ba6164838ced433fa86dea915e583e75fc046b

SHA256
f068d891a5ffaab8fb75ac89e4abefa20447d2880d5d117b8f8af984ff86a608

SHA512
55e00a7f81330fa40e0b9926478f912765abd67364d7fa133c27a8a1552258aa6dc1f949d458af6314c4c38d1e2078f748e160e2284a80582990d097152bc377

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
81626f9fdbc432bdbdae0063d2d5a4f6

SHA1
5cd49d356c3f6ac542c8bec594f672e3476843fb

SHA256
91786f6790bb46b910b5f87567a23751a7288b53fe45d75aeb4c071550a31f19

SHA512
d3c12bbafae51cab0fbcaef7163b447c9f9589f0906f129c56ed343a21f72a8f1f26b7b31fcae6ba6261fa0ad58494c6b39302d2eef59a8a482583afb5f347be

Download Submit