bb693c1b5e2f177465fc7cd5f39ae5f45acd5aaa43e01d413b2f16b601147959

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
30/09/2024, 16:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0234adcbd79b875669a50e488f06514a_JaffaCakes118.html
Size

113KB
MD5

0234adcbd79b875669a50e488f06514a
SHA1

56f339ed793e2febd5209912f56833ce8554130b
SHA256

bb693c1b5e2f177465fc7cd5f39ae5f45acd5aaa43e01d413b2f16b601147959
SHA512

26008bd2522b0f7652c1a6ba76e1cdbf950cabb465b16f664fb2cf03b4c158a75eea1a8282926769a8e15ea1b318ceea12778896ff95ce1adc914bf4d6fed3da
SSDEEP

1536:ZAKWbg389eC6Nc+ap5eOqYaKtFIeEaemcOXli7sTLkHDc8cNW:KbBGQeOcU6ehemDXQsuDc8cNW

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
456	msedge.exe
456	msedge.exe
2652	msedge.exe
2652	msedge.exe
4480	identity_helper.exe
4480	identity_helper.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe
4212	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe
2652	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2652 wrote to memory of 4836	2652	msedge.exe	82
PID 2652 wrote to memory of 4836	2652	msedge.exe	82
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 2500	2652	msedge.exe	83
PID 2652 wrote to memory of 456	2652	msedge.exe	84
PID 2652 wrote to memory of 456	2652	msedge.exe	84
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85
PID 2652 wrote to memory of 1680	2652	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\0234adcbd79b875669a50e488f06514a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9931e46f8,0x7ff9931e4708,0x7ff9931e4718
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2660 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:1344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4720 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4760 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6084 /prefetch:1
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5612 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,6366644890253103084,13944113619750376007,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2564

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4908

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\48e77d43-00cb-4b1a-b554-80bb53234c9e.tmp

Filesize
7KB

MD5
c00ef71c63a36fedb76094076556be43

SHA1
909bb11b3841e8b0cd59bf4b8e1447c53d52cd96

SHA256
043d1fc28309d301d7ac407b73b776c41c9eb6a9c6c4a38aa55f13542fcc0ee3

SHA512
20d9223669d587c6538c51a2f793dbdfc404be95e6743cd2757114b9cd9b0ea43a0a27f53957bc848d7a4d04ff665392424febcfe5d1b5680e8c2a4511082f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000e

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
b9990aed357ea0957baa131021588b11

SHA1
981d99f6e3520c31af511e7ed42fed485485827d

SHA256
91614522242d0dfbc93c4fcae7ffdb9bc8e9985e488506aa9afc62fbc562e011

SHA512
3d75f67e1cffc31c2d56c8b9b91e6991e8ccb9900ee149d2d8d970212cde98a7289727b460d60b1506167745cd224e61fd01130766d7cd81617cad2f9203770e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a1472bea12a7cdb5bf60f1bd9bcf130e

SHA1
360293e69185103bfd2ce8cf22cd6e839ab6ff99

SHA256
400a47d574f3c1670e3f755d1dd8dcd2e4923f4fc1d5716b7b3a3c455ed2aac3

SHA512
ed3d1e5c6f4e4acd2574d3df0a26b7813f14d7770252f3f29c4ee1a55321c26d2c0df902abec966c9aabe5d338ccfd6c69d53aa55f05658beedf1c643d568aa1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d6e374c12ed211b5edc4d6a7691c2223

SHA1
cceaa210f64e6fff1dde87b46dfb05a9b8ebc3c1

SHA256
5d7e7c42bce67373374acd66e07213a201835ab7f7e1b80726671758687400d2

SHA512
38ad9bbc1defb9777ac290a8d58e02308418d2bf28ef7ddc47a6fd2b253708165e6cb8752dc6f9499fd75aba8ccd2bdc6f72bb96f10ce6cd963b3039f2e406cb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e2e7b3638315e16671a1ccddabf0f88c

SHA1
62ff3c4c78660996490bb0ca1a51cbe7a273354d

SHA256
a934771f33ee8316a1a957f292aa261e445051d55d7f63ab493400da9a383386

SHA512
13adc717084d29f08c011aa7d1e012bdd445bccca92f8b9d5a6a4f1c59f07d996990a2981b0aa8e9b3fd00628dff4a467e4e5cdca4c67abd15fdeab5377ef6e5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c5f6e709783ded0c0f9ded9712de35db

SHA1
b5442651ff60ce41e702faa750461c417875fc8c

SHA256
30b1aa127012505eeb381b9435001e3f479b95f028eb5ed582394d4949c232ec

SHA512
d5e78723c81a02c3356311c67b83efc96e1e447075a844c5b1adad1c72b1be9cde786645e1839724dc11f1937092203dfb8b370d59ed76b410cfb2d2434cc7aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b266682b79cbb461706d23d3c7bc6c7f

SHA1
2001fae5737f9336cd1115c5f3027df8e2efaaea

SHA256
b56005a30f48ee7625b866f3405e8b8513d9e3ef5b311cc8e4c4ae0ef3edc6eb

SHA512
81e3ef6123c23260aa0a34dd4f5cf96b0cce8450acb4bc6516f0f0ca529092f91e52b13760b626f72cc30ad5bb88f295ddbce75f74e18ca75629b80cfc7211ce

Download Submit