a11b0181cf84175df0f1454a46c1ca64f09c72b440e10351ffbdb792dc8f8c00

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
21-10-2024 04:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

65777ca86959ad4b32dd9f9c6235c5e3_JaffaCakes118.html
Size

232KB
MD5

65777ca86959ad4b32dd9f9c6235c5e3
SHA1

86f296abc315c0774128dc83643aa0a70bbd8926
SHA256

a11b0181cf84175df0f1454a46c1ca64f09c72b440e10351ffbdb792dc8f8c00
SHA512

e1e71ae64c90eda5c5b9ab72bdbba07f1da01699225ee5b0281231e617c56ec129bf01926ec9bbc6b18203eaa76612837e7d018741675a11638ca91d2d2656e4
SSDEEP

1536:fuztRWw2y0j2auNYa1PuYqE2fH6O1T0ime5ZQ5yaeELuKdBh:fuzrxxNL1PuYqE2fH6MrkPuKbh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
708	msedge.exe
708	msedge.exe
4156	msedge.exe
4156	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
1588	msedge.exe
3944	identity_helper.exe
3944	identity_helper.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe
4156	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 5076	4156	msedge.exe	84
PID 4156 wrote to memory of 5076	4156	msedge.exe	84
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 1492	4156	msedge.exe	85
PID 4156 wrote to memory of 708	4156	msedge.exe	86
PID 4156 wrote to memory of 708	4156	msedge.exe	86
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87
PID 4156 wrote to memory of 4616	4156	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\65777ca86959ad4b32dd9f9c6235c5e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff829c546f8,0x7ff829c54708,0x7ff829c54718
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2024 /prefetch:2
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2092 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2780 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:2840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4840 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5492 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6700 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6040 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5164 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1996,7866030218396659269,3258223472375623962,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6840 /prefetch:1
  2⤵
  PID:180

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3796

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3836

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002e

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
51c19ec5779dec0bda28c48c0f2db0f4

SHA1
dcb223299bf9b0c1b1c6ee498b71526f86942734

SHA256
fef45138281c788834d58159d4e0ef8814dae0e6aaeb0da030ca1ded961fa101

SHA512
748d0b5e99e53ab2e8cde55b1fc7510d5ce2e5c42aefa8c9e8b54329cb7e146734b8ea2ac8e88ef76233207c9e15e233b1c9100747d311201f9f6113343637d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
360B

MD5
04bef8818ea6dc29e7fe1fbbf03a03bc

SHA1
7e93a7cf8e287fc4b67e8354bba1c3c129aef065

SHA256
f2fb82671b18725a566012e6e518fee21203d4e50aecd353f097be42c8ae673c

SHA512
3b6e484be38489181e98b427642d717318a29178db4372716100dc049bdef205e520c6e86b86b538235668182fbeec06de002ca776b78e05e34270f560f7a54f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
83c9c8658ab0c32839c89c8300ea41df

SHA1
3f841487c32e22ec75906d03b9dd0cd8eff34e60

SHA256
ffc59b75613b3df795b63a2ac5e42d0a6d317b2632809f9c0eaa6f30b30d499c

SHA512
5a2b4eda00be9b12db543985dc1c2f8e261a57c0c8b194efecdacda74c3af5dab2fb906ea16911fb50017850d6fe9124864fe93c3306d14c159efc7475312605

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
bd103600edcf5d7e4b13ccb1af02c751

SHA1
a67e99df4d2abba52c2eaa552527e1a255c9bd2c

SHA256
d47f38f685aed94ab60d3ff826300b5acb1dd905668ab6188231c5c097ae77c7

SHA512
c4bc38663804e8660c236d809acb7ef0c9996116a59ae6b10da3d9831c59ceb4b8b43777925143b8eaeab6d5818adc01328449f38b417236fc4a425da572a852

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6e84b0ad99cb709aa4c9fc9b7004230a

SHA1
44d09da5e4be1ec7b3bce3ca8a1f85d0a3140613

SHA256
b57216cd41c77d2ef624b1afb50ef88e51e6943f4ec3a154d795f85cbedf8bba

SHA512
0ca9179928d08a7ac2dffae580983eb0728b0af7346b037c87ecb98aaf14459ce21dc40fabb00b29917137ed8a618c67a4b7050b0492248291a5de5bd3b0b7dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5b6df2a633675ec4539b279cce9f50a5

SHA1
ac4f01f65a40d9d113445630600c94293dbf5021

SHA256
cd45e693a2a12ebc876b2de9b1db180b23eaf31094e25efea765d0344fa783c6

SHA512
83d140d293083f61e854521aefde5b092e8989a4642cf1755918ba6eeae449d476093861fff3da8ce64749b139a67cc6ebcabba91b23edbbaa17667d007bab06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
afe686cbe2f484c8049d67daa48dca12

SHA1
8fe963ff30b849677c2a70928d362ce828c96fa9

SHA256
7f0b593dae12e49f086031d5c8f7904fa3ae68adc61fcad915a96acd4200509c

SHA512
e3e657035f72aae86efadda6130d49afda6364bc1dc9b6cf11ac7ff88034c55c30e8584f3175b06884b576d6c3fc5259e828a4cce7a79b0402f038a3696a08af

Download Submit