5c82d6fbdf6cc55e9512c9bc6e8fd4089bd971e6a3d560343e3dcf2e56f6db12

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
13-10-2024 10:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f59860559cbdbe8d33f8451aa542f09_JaffaCakes118.html
Size

60KB
MD5

3f59860559cbdbe8d33f8451aa542f09
SHA1

e1799ee2ceb09eb0d78ed9a1936bc4b69becce09
SHA256

5c82d6fbdf6cc55e9512c9bc6e8fd4089bd971e6a3d560343e3dcf2e56f6db12
SHA512

7b24b45a198b4c433ea70276f945f4bffbb4d1156e43bf391e1efd38f402382439c19b338280f9c5d5c1a891a4fbeff8460fded91348f3cfc92ff708050bc108
SSDEEP

1536:osMEhPMFZjA/X9fb6XI3NAWVbqAPLOZFEp63ruS/VAb//Xb1T+KwLgtgfiy8sD74:osMEhPMvA/X9fb6XIeebqAPLOZFEp63U

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4272	msedge.exe
4272	msedge.exe
4316	msedge.exe
4316	msedge.exe
3676	identity_helper.exe
3676	identity_helper.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe
640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe
4316	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4316 wrote to memory of 3648	4316	msedge.exe	83
PID 4316 wrote to memory of 3648	4316	msedge.exe	83
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4432	4316	msedge.exe	85
PID 4316 wrote to memory of 4272	4316	msedge.exe	86
PID 4316 wrote to memory of 4272	4316	msedge.exe	86
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87
PID 4316 wrote to memory of 3524	4316	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3f59860559cbdbe8d33f8451aa542f09_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb938846f8,0x7ffb93884708,0x7ffb93884718
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1940 /prefetch:2
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2364 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:3524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1964 /prefetch:1
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5384 /prefetch:1
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5504 /prefetch:1
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1688 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=1688 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6052 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1892,14887909587289145569,16669078890571841899,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4904 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:640

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4940

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4064

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
6960857d16aadfa79d36df8ebbf0e423

SHA1
e1db43bd478274366621a8c6497e270d46c6ed4f

SHA256
f40b812ce44e391423eb66602ac0af138a1e948aa8c4116045fef671ef21cd32

SHA512
6deb2a63055a643759dd0ae125fb2f68ec04a443dbf8b066a812b42352bbcfa4517382ed0910c190c986a864559c3453c772e153ee2e9432fb2de2e1e49ca7fe

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f426165d1e5f7df1b7a3758c306cd4ae

SHA1
59ef728fbbb5c4197600f61daec48556fec651c1

SHA256
b68dfc21866d0abe5c75d70acc54670421fa9b26baf98af852768676a901b841

SHA512
8d437fcb85acb0705bf080141e7a021740901248985a76299ea8c43e46ad78fb88c738322cf302f6a550caa5e79d85b36827e9b329b1094521b17cf638c015b6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000025

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
fe9512a486cc99a068ae5813bdd884d7

SHA1
704e2d65e69d834d398ce5a08759c5a404f75c5f

SHA256
251591a6015fb3741066b74a2b708706647f237d6d5264e3aa626558583586a5

SHA512
88b0c934891f78b21aa9ca606063002b42e5ebaa98a1830663855e4a7f6c0f71f75f59ba8d194ac2457b697762ca126ac97a589654e158cf9efd5e8f2bd2915e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
e5f5217d7e66f6762ea270bff3a6351e

SHA1
788153c6eb5cf573cfae943e7a7381704a944ece

SHA256
688614724ffa9ab90bb0e0ae5db5e24fa91c0a69e617de74ba583f75bfb14ce5

SHA512
9487f252da72e983adab007f8a56be233198367ac7fa1d40f91f41bd722377ff2edc54b47b652f6f0d4828fa2ab7d32a53e48c092f6211e86022aca58ff00357

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b1d68c1c718c7cf08ea97525d88ec823

SHA1
33a630af265005b7b3347e3b9350f41d87eee10b

SHA256
28abde86682e8f9c8a2e0d4d50b9f5b98d56dd33e74d5b7f498a5345ade890d9

SHA512
6065c585ab2685a4f3b363715b14748352645377b74801f888b938deec62906dab9444f5c9215bfd4290d3c98c11aefaf48997a9c47db748b90e43a09f938502

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
576a805129c0d1f3362e174aada5b8ea

SHA1
eccca2dc6cdcc1e35b4daac12f5fdf8cf7aafebc

SHA256
b69499b9ddd823b1d98497e641727d331c07819fcfe69f63eec208b8dfffac20

SHA512
4e7f9f66f75e852c8605898e490f52f637991dca1c1560b15552c3908dc50ab7d8437ab1f6ee57ca4cbc2820b4d2fe22d3c15772e96a8256200df7c3e0937dec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
516db9c61844832e63a682240331d602

SHA1
7f2724fbebabec62a6d7eadac9c036f6a0718c2f

SHA256
ead18ed1688c3863c54ea191628fc1498e18b462a8c363a597fbb0d65a5ddafc

SHA512
15c7f44e4948c642cdf98b85d04cc41d5987a758e6ba44ca59c5b50ace947c8271ab2a77e7adf22a2a52280c2d3ef7e28b435dc803db09ef51ceae1cdd68ce56

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
be6cc5a904690029e04d0585e4351a96

SHA1
dfeb41f87f700cea565368b0b2e83aeb35e5b069

SHA256
8b89fd9cc9cd48ed9cc695fe41485b26f43f7ef58dd5800de248678a35e6ba69

SHA512
1cb33e8cee4b533551e1cf19b5e99b9d8d963d7a27f464a895cf45e47e5786007f16a078519993548fbf99294f94b25328ece938c5767b4518e569959df9d22b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
52504f5c46bd4e35ea752fc9558e4047

SHA1
1d8d95ba3d16eee1bd55b8e5244a17264325a7c2

SHA256
8f9491e0f4e962d2632e99fd9920120e99847b236273bda41d2add1550ca8106

SHA512
350bb008f13ed2bafdf65f3bd7f9e51d6c9ea226583440cec9ee16ad7a392efaf08b9033fbd2da6522966c6b4e7f69b15a4d1b766fb5e2b63c85377d619cb70b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
f74d1f370649cc9b08d32b43b978ae63

SHA1
1ce1fd04ff170b03faf3e5b76ddf290c8cdfae93

SHA256
bce69bff220dc69e6f6b8011261127b7713f3d4ebf0b11d86ead63a6dae32891

SHA512
2f2e58c65fbc89b4c6a63a8ca443c6532d776cc2d6bd787ae3c7a3b876aea7dd5eab16ed3c04c3f3007cf83d276b014d297d04a8c8fe9aa02eafb87565c1287e

Download Submit