6f4cde225e608cb9c734763240916ab80744f93e127c934547284ef149f24ae1

Analysis

max time kernel
141s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29-09-2024 17:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fefe56c770e68579a18e133c17c150f8_JaffaCakes118.html
Size

30KB
MD5

fefe56c770e68579a18e133c17c150f8
SHA1

7242b5d79e692e3c64ac9cf34376178ccc5bed6c
SHA256

6f4cde225e608cb9c734763240916ab80744f93e127c934547284ef149f24ae1
SHA512

10b4af4099918487277a7ba257b4a479408ff8cd9bbcf631cbb572ccf678a671e9a065e96877c220fb591ce87c8bd5d6b47c4d35c51446e2c0b13bcd431ad4a8
SSDEEP

768:FFUbk1b4p+b2vbfOPab/O9b1qdOjtmoGeb01Jb4JcYAX2VUgnP:FFUasp+SzOPabMRqdOjtmZrtZGWAP

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
2924	msedge.exe
2924	msedge.exe
4056	identity_helper.exe
4056	identity_helper.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe
4744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 4968	2924	msedge.exe	82
PID 2924 wrote to memory of 4968	2924	msedge.exe	82
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 2556	2924	msedge.exe	83
PID 2924 wrote to memory of 3528	2924	msedge.exe	84
PID 2924 wrote to memory of 3528	2924	msedge.exe	84
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85
PID 2924 wrote to memory of 4456	2924	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fefe56c770e68579a18e133c17c150f8_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe8dff46f8,0x7ffe8dff4708,0x7ffe8dff4718
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2196 /prefetch:2
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2836 /prefetch:8
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3200 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5224 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5600 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,4489270673906296458,9619151704107190782,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2724 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4744

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2448

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
478596b7de5b54afac6c9a66c2c130ab

SHA1
8ab13b25bcc533c94ebe86a157c9aacc132475e4

SHA256
37212d6f736f5e0e38f2acf6ccf0c5f3b03ad445f085ca9c4f732b5694929fb3

SHA512
060767b4240ef56553b9e437366435955c275821b3492d9e67487a0465e3e2508f59c4dda5f6a1d94725aba8c935f2f2f74fac259d7724af027530fe6ff262eb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
8d6661d464433a27819dc9e7e407de42

SHA1
f0e0f6e69036b146584d99fc4812a17bf302b180

SHA256
d1d28d2d82b02bf4775ffdb22c712a777eaff40e59a06f6e2a025f7ab9f35ed9

SHA512
9922a765ec114efed9a934d0521ba2936fa3905facba94cc8fe07ab0396156766c531f1be64e8ea3c3f205b4d639b57396d5d2c53ea00579f99a7a1e38e25001

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
987B

MD5
11c5b96e5901175aba41ff825f510206

SHA1
11269a9d4260ed92696ba41bfca2ad12874df807

SHA256
c47847b1ec998c6638a3025b8884eee0f87084748cd664c766037264e6c1e8f8

SHA512
12b3a8f9ac10cd494cbb9d23875f1bfd81996130e9ed468bda2bfec731759e41101cc860801f52e3be66fee519e169c7fd289ed7cf332aa2e78692b2bede29df

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
987B

MD5
be9d33f85efefbc1033693a76410dbe7

SHA1
dcb7d4511d3612ab1a3cfb3478c14e08f1d3f60c

SHA256
084ace64f63c707804d54481b9f60c68b274a051e6af6445333b39dc4db2b580

SHA512
1600697a3f9ca08f5dce01576753c8e48ace2f2b5ea8c8d8a8bbc5210abf434d99d016f7ea328512d4f88e95de85708ad11578149e264908714bc03fb4b93bd6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
626b1f54ea1c2c167475036a4eec9a27

SHA1
b59c6357ba4be639a9aebbc6620e9afa5af97c6d

SHA256
c91be5007fc605a0a9eb6b9a633efe53afd69a7d8ce95ec6d8254e0a2a563eb4

SHA512
7e61014ee0276c775032216892c33a1ae2766c7ac8154a0d2a3c16257bc83e375d1a70af038a363c8e78987592eec3e18d4fcfc29839a68538c14acd40141971

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
4bf980591fb4edebc1ce09db40846c4e

SHA1
e0ff556a20b57f7c9ea1f5321163ee67a22d7b71

SHA256
434daf11fcdf7edd037e72b52a0a9b90e9344f8afb9d7b1b0eaa7d58c9753650

SHA512
7b309eb2a246905ab261e76f214d57a5c4c0e00992d730ca910ada82e291a89325b75bf4e47528126dc43a496efee5f5a0d10be48081ec096cdf021791cc2d32

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6c9f135d8c139ecc90bc5e2f0c3f5e61

SHA1
8a8752449a86f3a96ed1d4f7354ae1444617f092

SHA256
83ffc4d06d78b3e9bfe15de021f24fc5e440a66ee1ece3c89c68d083ea54ff9b

SHA512
09af47e85ec915b4565d6ef7ad5f9508319312e43fa75f82a33d217ab21282b76781a7fde3dcff88025e4180c1d2888b820daea7a3149c3dc0171dcea4112657

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4fdbaffe58f796a0306e795e583951ff

SHA1
de30487728f2072274298fc2a8798409f716b6ca

SHA256
bbf6271d57d8650248a189461fb94bb50d18414be0b27d53aec059b25d737319

SHA512
2cc650080bf046b52747aa5c17bb908765602629f1939617222ac5e85b3f0cf29977594fafbbed8ac84447ac3a773e2af3f4d714befa89151ef6cca44a7e3f01

Download Submit