e5d4fa3117b2e3854346a40f3944d6c2af0f0bb1b84769db9fb1dd50e8fe6c47

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/09/2024, 20:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f6cf5a544b79380066d9e8a8a0743eed_JaffaCakes118.html
Size

60KB
MD5

f6cf5a544b79380066d9e8a8a0743eed
SHA1

a96e193cdb207378d7a9d33c96690e4d53d82b83
SHA256

e5d4fa3117b2e3854346a40f3944d6c2af0f0bb1b84769db9fb1dd50e8fe6c47
SHA512

9ef300d8a0bb52aba9c46ab251be9e20975e4b309cb044bd7af5f0587fd437eb0b0321cd60827973d8a8952d643b83607ee184b55db01c5a2682db77825a798a
SSDEEP

768:hgOriWNcaSoXoHkcvZmCOOcAStytoJ3N2wWRXRce:WYoJh9OO9toJ3NYce

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4612	msedge.exe
4612	msedge.exe
4588	msedge.exe
4588	msedge.exe
4240	identity_helper.exe
4240	identity_helper.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe
4588	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 4476	4588	msedge.exe	84
PID 4588 wrote to memory of 4476	4588	msedge.exe	84
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 516	4588	msedge.exe	85
PID 4588 wrote to memory of 4612	4588	msedge.exe	86
PID 4588 wrote to memory of 4612	4588	msedge.exe	86
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87
PID 4588 wrote to memory of 3384	4588	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\f6cf5a544b79380066d9e8a8a0743eed_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffdcac46f8,0x7fffdcac4708,0x7fffdcac4718
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5228 /prefetch:1
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4136 /prefetch:1
  2⤵
  PID:2568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5148 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5304 /prefetch:1
  2⤵
  PID:2684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,8298283838040857144,4439386286022798879,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=7012 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3436

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3784

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000008

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
9914fc8946d3a8429616f3ced7344b59

SHA1
5465e4dd4170630cb3043ae1cb19d2ed77df70ca

SHA256
afec8b35065c045bcb5f86ba6e523d242c9f90f86732c903cb1223928d567eac

SHA512
6e6c48fbae5b4e5e51974baf5d95a0160c092d50e3567d542eea9bd04bfe0eafe6daf8b3eb0d6311cda98b56a25454be4758e5ed7276153dc84b8a6d79cfa946

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
4174b93ecb1d2358ca8b198ecc496296

SHA1
5cc69400f25e513a0935d9f6e0b034d7384f6921

SHA256
790f114fdad1591a5bd362f1e72f183181165676aa904f24bc760ff1898e26af

SHA512
aba05e08ffb83785754ffe38b3d5fdc686a14c0d4a6023a0103de8517c5bbca9a35f236a30c9b20cf2882f1b2243adc3d1a6b02f53c6dd063cef000b03b85473

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
7c6d8fb73913ad71152144385b812483

SHA1
3c160a40323e6dc9dd70bfd4605ce7ee58c4e161

SHA256
6ff6df31a82afa3695513c1f40055ea957db17523bc3c42ea42ee0044359f3e8

SHA512
3b34fdedf101679945f877d33b5ef0d09a230484706652e71217715e17894a69d05f016bac4f6a396ffd37eb5603166afd28a71d83a4cd9442d9449fa82f8028

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
77f922c9f348693e1159a0ace9f347a0

SHA1
8b301c3b9169fa0e39b41bee092cff2c8888e737

SHA256
33d94dc4d33662a53e859061491ed3b2d5ffda3d2d263226b81b0dbca76b4aec

SHA512
dc7cdc09b4be061c2e1ee10d5890cb61fb01a2605deeef5953e7611f24dc505639cc693df66bbaa2dfaa16bf9ff222fad17bd1a12554dd4d38368c7d8dbaec79

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
925f3df552a9cfc680a973aff4bd0c00

SHA1
e3c4d03995e23e14d00df3346919e235ebc7e6b3

SHA256
027a446c9d380860b77335aa95f47d4fdc5ed6f82b9394b83ed3cc20f898154f

SHA512
de42635c36852065386eebdd3f16af1cf1b020b4e2dce9b3ef2bd4da8c1ffcb59afbbab7948ff07a998b593332ab47739df70e646bdb27baf7aea25f0a80a5b3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8c617d2d7819ab499dece18787fd3117

SHA1
76d18e730ce3bb5f316dde6c61436c8be0da443b

SHA256
bad678e320c2d2a1a1e6f264da5a956426a4896bb20e3dcfa4618845377755a3

SHA512
4dd1b0533f7bf32bab02f05c17967e3eae2b1fde18a0dc5d699712d322bd6dfcb370e88b589c04dd380f56fa39f1491c5e4ee5d048e3b64bacd302d26ff1d31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
824bc2095a9aaee7c79a2cfd13beacdc

SHA1
c38d253d132f7e12fc4efbd5b01601454ffc645f

SHA256
d6a8d2180e9b7f7df43a175d595174015d785bb62eebaba612e20c7384ab3447

SHA512
da30ab9419ec5ddf422283768d9551b0744877bb3568ed1bbd6dc3f70f16c2c1478ed155e263b2f2c14a64930febf7746ecb90e805ab8ae8b1384ba7a20edeb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
8a84be54754f0a03d6c345d7840c7efc

SHA1
3ccdcca020b66f3adad867efa3f211fd96393a69

SHA256
24fa80816320879cb74d4db3d6df818eb34edc0f86d87d96fafad84263151232

SHA512
7d2bff55cb361f59160430681fe1df4b9b1676d5b9714b8acc0f07a159b5d002802ca1ed6fdbcee14343664fa54ef59c6a5ab7a527a4e36bf66b82a0bd3a8ca6

Download Submit