244f4feab193a70b8ce1774e5e80f740276cdda48f5633a5b79c0a7157e25be5

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240709-en
resource tags

arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
submitted
26/07/2024, 12:08

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

73fc7f9e1213a8ac099f793b7625b70f_JaffaCakes118.html
Size

80KB
MD5

73fc7f9e1213a8ac099f793b7625b70f
SHA1

e25ac781b8d67310a0e6d4f7e3a71d5223c893ba
SHA256

244f4feab193a70b8ce1774e5e80f740276cdda48f5633a5b79c0a7157e25be5
SHA512

db69737b6453fa73a2d4e373aacb36cd09cb7616a36548fd5ecda6c75fe9f68721d54ea0a079694e3427b124fb1987441afbd0eca27b1b4072eca2d1fc04e442
SSDEEP

1536:zv3klcWklcaklc7uG/bI+3SkcXklcPEijZeqhREijZeqL8Y3eDEFZK9VZpjVj/ek:TklcWklcaklc7uG/bI+3SkcXklcPEijk

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
384	msedge.exe
384	msedge.exe
1908	msedge.exe
1908	msedge.exe
2316	identity_helper.exe
2316	identity_helper.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe
1908	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 2460	1908	msedge.exe	84
PID 1908 wrote to memory of 2460	1908	msedge.exe	84
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 1916	1908	msedge.exe	85
PID 1908 wrote to memory of 384	1908	msedge.exe	86
PID 1908 wrote to memory of 384	1908	msedge.exe	86
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87
PID 1908 wrote to memory of 4848	1908	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\73fc7f9e1213a8ac099f793b7625b70f_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff817a146f8,0x7ff817a14708,0x7ff817a14718
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:1916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4000 /prefetch:1
  2⤵
  PID:808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6348 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6372 /prefetch:1
  2⤵
  PID:60
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6104 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2100,13876328276541156442,6876636913135161161,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2640 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1524

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2428

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
c7a59d93ee01bad4138899260d0931c9

SHA1
b48713c937f6c75f016c971f0c211ba35b2b575c

SHA256
ee881a967c200f2530b302b8ae27edc15318acd08a6e581a065e647ca01a9880

SHA512
85abb3a2e9ad5ab4b2feb332936b49ba2506116d9e9b5c043165bae425e456aba11a1bc3ea29d6c73cc8896b3c412124ed1810826ab88de4b109daa0e90f3c11

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
04b60a51907d399f3685e03094b603cb

SHA1
228d18888782f4e66ca207c1a073560e0a4cc6e7

SHA256
87a9d9f1bd99313295b2ce703580b9d37c3a68b9b33026fdda4c2530f562e6a3

SHA512
2a8e3da94eaf0a6c4a2f29da6fec2796ba6a13cad6425bb650349a60eb3204643fc2fd1ab425f0251610cb9cce65e7dba459388b4e00c12ba3434a1798855c91

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9622e603d436ca747f3a4407a6ca952e

SHA1
297d9aed5337a8a7290ea436b61458c372b1d497

SHA256
ace0e47e358fba0831b508cd23949a503ae0e6a5c857859e720d1b6479ff2261

SHA512
f774c5c44f0fcdfb45847626f6808076dccabfbcb8a37d00329ec792e2901dc59636ef15c95d84d0080272571542d43b473ce11c2209ac251bee13bd611b200a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
b95389498e15e3bbcec67ef593e5f1d4

SHA1
3d3245d4de001d1a708384cef42f4f054cd84150

SHA256
3eede3083fc8a7d3252f5d885d6d872bc2fa7ff9056743a2cc59505e6b3b7ab5

SHA512
4fa9c03525f2245d7b3b476b984755dcc3533fc0c627ed60c11d3d0fc684ac924d3c86907c3d28b61358ed2b30e90e1c161ab3d323cafa32a5ec8d5f7684701f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
881498f18a52d28f9789bc787cd310c1

SHA1
2a3defa605c9b4ec0aa4f74accf5f0d4b9607bea

SHA256
8f5b5f02d0a4692c25e95290d5d734a3b177b79f69057c856cf404c69726ec98

SHA512
a030bed343be5792562f39c4f97e7b7efee7d73304a7f87cbe2bc4ff3356c341d086754ac5586486e1517c30d393bef651bd2a3c5b9d4c7832876acda8c91ea2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9f21ce79733f43a6d92d259b2b680c5

SHA1
da3099794055f034527561174293a92b64473d2a

SHA256
6dfe8717f09957ace9b8d325e205e689b1f7898110d286fc390a864e00b1497d

SHA512
5db22e28f6aadc3217e07fa3f6041f7378c94237beee748478c746d6c0eae9cb7b5b7f53e8041a0ea36f03fa1c50541d3283288ecb1b035c2fa4606b6f226ba6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
618ed1888faa1efbf31f051d2e322d17

SHA1
58dd8a3b6762723ec5bb042b9e2a486baccb4aab

SHA256
39f1c554d85e18e0dc70e0c26acb00751925021f4f4c49296287f5cf99bae149

SHA512
9fa1c07cef30209a949b2c1b0511a41b8108db2762bda96d98921ee1af0d0f25fa9bd803549599e3fa0f1776fd4aa6848c7e3a9d2c323bd350d83c6e8107a261

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
12c27514595a21abe838fcb5406ba299

SHA1
8119d38fee83465a7b7b84e17976d0ec67282cf8

SHA256
45d9c6036e7dd59c090ea6d20e337de46066cb32d3834c81c2dcc7ba52a1583d

SHA512
70a15a1ded3bc3807f78b3cab7315f275f0631ca64293488bfdb793ed1f2a47d2c072f92a8fd9c7656f942c1694d8b00701302c5c23a8fdb939ebd83fae7eaac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
b0e06a65f95112827f0cf29f50040dd3

SHA1
bf192596d4a58b3c5996a81d45798c74b7c427ea

SHA256
bad3e00bb4d04bfdeed299f15a26eeb1d848f52ffe8bbe8280105ceb02ba5d0b

SHA512
b54bf3e5681b29173ca698e5b9a290ee6a16013564909c20fc73e282d738745badcb187595bd9f6fd24da3dbe3e306164b53439e58b244411a49515e14517344

Download Submit