1ae26d1574ffe8115e547f041555eb039264c0c8e66803e39b2940132d4625ac

Analysis

max time kernel
142s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18-09-2024 20:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e9e3c6b9b89d1869931cdbd142c6b650_JaffaCakes118.html
Size

55KB
MD5

e9e3c6b9b89d1869931cdbd142c6b650
SHA1

0d45678ea8e16c4d9dd0b30b4e982647e530a23f
SHA256

1ae26d1574ffe8115e547f041555eb039264c0c8e66803e39b2940132d4625ac
SHA512

e88c4e9dd12d1e508bd62b9e877ae0d0ce68f9a4a97c641ef9f258fe6e84ad32e2581219bdd2fcc97f8af3a75a6bb2a3cfe23c77334de155ede8640db0198173
SSDEEP

1536:YNrWXFWft7r8spr7yZeplqgxgDmHPkvUvNp/zdRH:YpG4r8U7yZejxgQ1p/n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
552	msedge.exe
552	msedge.exe
2484	msedge.exe
2484	msedge.exe
4332	identity_helper.exe
4332	identity_helper.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe
2484	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2484 wrote to memory of 4488	2484	msedge.exe	82
PID 2484 wrote to memory of 4488	2484	msedge.exe	82
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 368	2484	msedge.exe	83
PID 2484 wrote to memory of 552	2484	msedge.exe	84
PID 2484 wrote to memory of 552	2484	msedge.exe	84
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85
PID 2484 wrote to memory of 3596	2484	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\e9e3c6b9b89d1869931cdbd142c6b650_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff204346f8,0x7fff20434708,0x7fff20434718
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2016 /prefetch:2
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2172 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4692 /prefetch:1
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6100 /prefetch:1
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5744 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6012 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,5942209562384757766,5858170418087805414,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4032 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1000

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4732

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b270c90bf00f12e87ed6dd406c9758d1

SHA1
7986307dbacd941042a4d9c9caa4c4c46f6ae58c

SHA256
01c4e05675ac6bc1e09968db0e6e5c58ca59e6408f0b2f9007863aa45f852077

SHA512
89ceee7e4f36e98a9d43208f633da776bfeb29aea2e27771bd0ab73d86cfce59fa6333b1d7d5567604fcda01ee272dea07a801e39e2e550c1b9b82cd415aa304

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
fc2c8d575ef7faa040066eeb29bddd90

SHA1
c0d0d550623d5a17d85ac39ee4c3058aaf54092f

SHA256
884bb25fa494de599be173d698e0a7900909621421e2c753f92d1b54709cfa98

SHA512
1562dd964e778b958f587c8bcc8075f45646f51baac15c80d47b7fb7dc32bc449282779e1a2332f5ba4795ff3e1319d532baf8378c34a805d8d6330866aed13d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
6afbfbea59023d0cffd21d15f9b39f36

SHA1
c56f97eb1c03543339ec8be9bcbce3c298450b81

SHA256
85dd8a193a5662fdc1838cbf0000f60deb025e2a524d7fdc885c6de2a29462e0

SHA512
a574c9803e9ec30d729aae3a3ddd8d51d86571c11678565f8312ba34eb3330d5c092f31a5d30f0a63596b296b9066361dfe5a5ff99c7197a196a3b1cf464072d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d2869bd26c054845fcc1d98cc504cb0c

SHA1
0caeef8615adc68fabdb231625a6f6253f8a78d6

SHA256
cb1bdf57065c7911f1c398b80980ef5389bfc085666b53bb345c384a38eedfe1

SHA512
1dfce37eefe1354c1146f5eee06b877ab88fed4bfdb75f724a510cbf2e0dc2e1c0253a644df2b1e386cf3ebed101ac5e41a3e2d79becd620c41f3d7fe7ad79fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f025b988948a3feea0f0a2821783b03c

SHA1
32ee41b0bc09e966b6d4f893448cb4d0ca4656f4

SHA256
53728298aaff7b3371be677d8a764d0c5f90a02251aa65f635909a223a857d77

SHA512
c9e0df17aca61b4165894e9ba4f53ea0c779496d6c62dd3e01df6f39aaac4cb9db8d9b0adcc9fa807909f15a62743c85a8a8a73c7957741bf3e74aef5ad5dd7f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
998aad1a0e6b0953b56163e706732c2c

SHA1
4679defc557dc2d7de2675f6fb2dcfb491b1435e

SHA256
9991a5376e072b51c56337440a8a4a67d108cfdbdd9d38f9c52b24ec49a3d2d3

SHA512
8bd65d0de7a8a87e651836e462e3d3231a9efb70c2263d14438c4aceec52597ae311cb80a88173b81cfca10150e917f928c63b681c9caa10b6bd2342313cf9c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
0ba679db46915511acad083341dc2041

SHA1
f9bd255a90abaff38e22c77f258e19e7fd13c0a2

SHA256
72d51323e35759f55060081506f81ffb9a8f52722f8b616a4ffb0c7362a27ad8

SHA512
a0c0b8bc85af78579ee8f2d78d34d371861e83a0013b58c83fc6e015bf9eccd82648083f4fbc06f3597ba01c478aeeeb621bd245e7bc46a6fd6f68e27dbb4450

Download Submit