ab5eb60275c541e8d3b177ffef0285dc71c7bd25a771b63b337cd8fb9c550812

Analysis

max time kernel
142s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07/09/2024, 16:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d25b4319707a5d5a0553696bd675f33f_JaffaCakes118.html
Size

121KB
MD5

d25b4319707a5d5a0553696bd675f33f
SHA1

ff049bbb8b14dc22af4d095ddb5e82b36c011a1e
SHA256

ab5eb60275c541e8d3b177ffef0285dc71c7bd25a771b63b337cd8fb9c550812
SHA512

8ce0ee4f983f9e1b220af01683a7c1e52b03ed3f32b2631d2234cb505cc70d3db7a930374bd82a3088ba3bd7cd2a8b8dba394a71e9052fb85a7067d3655ccef9
SSDEEP

3072:Dm3IQzA9bF7R8lXUv3y7hJZWpTvTW585IqKnFa:jqs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2180	msedge.exe
2180	msedge.exe
2172	msedge.exe
2172	msedge.exe
628	identity_helper.exe
628	identity_helper.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe
2200	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe
2172	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2172 wrote to memory of 700	2172	msedge.exe	83
PID 2172 wrote to memory of 700	2172	msedge.exe	83
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2348	2172	msedge.exe	84
PID 2172 wrote to memory of 2180	2172	msedge.exe	85
PID 2172 wrote to memory of 2180	2172	msedge.exe	85
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86
PID 2172 wrote to memory of 744	2172	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\d25b4319707a5d5a0553696bd675f33f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9a90f46f8,0x7ff9a90f4708,0x7ff9a90f4718
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:2348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2720 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3212 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6108 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4660 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5940 /prefetch:1
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2232,945768325195748759,15871153253942882024,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5132 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2200

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3960

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1088

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
980c4940ae60bbe1b13459035d31765c

SHA1
6ed7ab8e6b274f3e510b7ed6884260387a25337d

SHA256
f20205d386497d84788bb1dbe38308516c663eb671c5040b179fe58fdbd6fb1c

SHA512
df0c5c733cc071bd2cdad6756d9269d1d831804ce5afd30ba66028428911e4bf26274cfef4e90471c521c37d600e589243721f6d0887038c393964922e2c113c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
ada428c523a0a2f5b151d361bd6a25f5

SHA1
50cf7fb61b65c1b5e8e06a56bf86ac160e6a76e6

SHA256
58dfd1d31513b06963945f428743d242cdc6d15bdb12c2a365009c77f2b8e938

SHA512
e1853a0285943caea56d254bbcc34df1ca9df8f3b2540016a4dd6ff510572c6776d30dceeefac9434e2e6e5895a13fa8dd5de9838c5e7c427d212da7c33f854e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
bdbf36f3490fd7a131ace8f41ae84962

SHA1
2b4aa4ba9f7f0e31b66798cadaffd5278dea7824

SHA256
0a1a398bf78b713a67c43335586cc980efb56550922af9ee25d53858072ab295

SHA512
affd0bc02c17a3fdb3ababce72043b1b269ad6417eeb11c2aec3d02a745194a0dfdeffa6ca49c2d22054cd0efc9ecbd9ffbe19631d14da79ace85aa0ab198878

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a72086b3db8dd8c1178525ebdccb8845

SHA1
92a1d5eb97af4d4dd7c08820e9b331fd54c7fc08

SHA256
0a9aa3a799f0b064176f45eb0bcf2cf4d4e1dcce040df74a61cb826d03e847ae

SHA512
cd863deb9db85f9047f2ae666b16134f452eca55251f9c4282551b87a5caa98a4a6945a2c0b1f08bc99a324e5003b6a013a12a7624723c9fc4ec32c79e72ca76

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a164b677c85cd94bdedbca91259b315a

SHA1
249d92c19025d58077e394397d68d17b7dfabcce

SHA256
919964774ce9f52ea1196875db24069e8ba76ab62f2085556af4ab84e4d85744

SHA512
369ed6900359c42160ef54c610b9cebeaf0fa9f913bc93f4d8bc58c442277162fbe1911e776d97f96c36a33bcf30765c97fa9478751a298fe6627964e39d1e83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8251420171de515fe53ad2458663468e

SHA1
fe8b3e2049468f2a8ef61ec3d3ee1a18388b6a40

SHA256
b837e2ff3e060a89dc27c2a90653c42a9f581069aa0b5b588c172542e3e22eca

SHA512
c7faf04d793cb6e51b3a9afea89d4a1a1cb2ba58b6734b261ba45ae811bced1332937c1e770196842e60dcd43a03f570144a82a3934af05902224805d74a8c14

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c653421c71c225e1a04f641f249d60fb

SHA1
d8814c7ba152dd12f8509b52e84ee8ee10686ee5

SHA256
971926aa29abd6fd6b93a0b1a824d382b2c893f5d7e3f2e76eda7e720146c1af

SHA512
0849bb6dd01c0781cabfb0c167f6a7c521ad829ae7cff0369227df6e25c1a6affbb3de6867e084d3c3b5c5ec6590743467ebe85cce76a791a743a48647e804a6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f2a3cd28c999620c911f3b4104fb8932

SHA1
cc6fdeca3f46d1a9d28b1a9d65f215e809d21733

SHA256
63275ee0cef9995e60d0acede00292a550a4ce42ded445860f3d3d21e0918eee

SHA512
6d680b2dd57bb43cf9731db8f31a4cfd7cdd16f706f89abb4d9746ecff32ed5d89450519848519b567c46b2ed2bfcf92999668fae512c8ea2e2fcffbad2477c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
dd89c4b79c7f2cd675bf5c070f2d1f1f

SHA1
8642fbc5510b3cd21be281941629059720dc0a17

SHA256
797da2e44280b1692ab6113fce84f65975bbf864d68bd70c66f5d3f99d94f27c

SHA512
2e10335890dcba71e32bfdfba9c02ac90349c8cb196c1065310f5c74333dacfce45c0cd34a70ee9b36ea673092daa80f78a75de90cd0e490d893409a4be8648c

Download Submit