359aa5ee6b03d8dce9584e82627e63965237d836d10afad4af440520674a1075

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 07:05

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

85357c81c367e9750592a611a22b1f52_JaffaCakes118.html
Size

236KB
MD5

85357c81c367e9750592a611a22b1f52
SHA1

3c81472bcafe480e12128bf29952781a02ad216e
SHA256

359aa5ee6b03d8dce9584e82627e63965237d836d10afad4af440520674a1075
SHA512

f9d1fc0eb356e4ea02af618c4c6316cc2105c95777a4c0819201d76bdc0375f11d262f7501512eca4bd0697d15f357d7e6e523cea03456a273634e412b98962a
SSDEEP

6144:z5HcIIIs3G4k5QhL8atVJBiVQ5MIsuQyf5bTM+MdBXpKgXpgx4t4+rCgYFO9mgeC:FcD73G4k5QhL8at9iwMIsuQyf5bTM+Mz

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
23	sites.google.com
28	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1028	msedge.exe
1028	msedge.exe
2064	msedge.exe
2064	msedge.exe
4020	identity_helper.exe
4020	identity_helper.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe
2272	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe
2064	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2064 wrote to memory of 3800	2064	msedge.exe	87
PID 2064 wrote to memory of 3800	2064	msedge.exe	87
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 4804	2064	msedge.exe	88
PID 2064 wrote to memory of 1028	2064	msedge.exe	89
PID 2064 wrote to memory of 1028	2064	msedge.exe	89
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90
PID 2064 wrote to memory of 1612	2064	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\85357c81c367e9750592a611a22b1f52_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff5a8746f8,0x7fff5a874708,0x7fff5a874718
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2804 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3268 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5432 /prefetch:1
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6276 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6076 /prefetch:1
  2⤵
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2096,17010094984684680678,11435063358930367830,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1360 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2272

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3412

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3260

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000022

Filesize
67KB

MD5
b4b711f3e747704ffe02b49791ce8cac

SHA1
ac7ce4cbd3c8ee66e3c8d9d209c1352c160c3b89

SHA256
f65bf40e2f0ce993b54772f703f72d53f0fa925457346fa8ec2031879ffa91d1

SHA512
b738deba57337a9147927f7dd35eab7c999dea6d2ff11f57fdc2e5b6f64326028a54778886548ba128a3f03ee333cc9e43de5162d8b578b85c290626577042db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
240B

MD5
13a3223de63e9537772d5c84428d5bdb

SHA1
2d0c6911bc3c8c5325fa523f5c718de4df4b3ffc

SHA256
68d4e6cb34645b0903db6c589f51ab0e925d9f7af469caed0818c9a62826fd27

SHA512
508e3c2a40b8fb562e6363d79f6dedeedef078ea10419e18d0716519766c000ef433831ebcbcfefdb9a3058cadebcd2f96935a62074d9c1e51c54b1ca976fb40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
e9d2de33096e5c163ef8f1c900ac4c9a

SHA1
98f57147503aeed7ce2c09409bd3bb8b3e63a966

SHA256
e85e9ab3bd93252b6f41a1aceaa5e45fb8f05395e57ecf5694fe5fdd75aeec09

SHA512
f9c7de19f07470a75abeef0d60f4a944f32fd5297f1c29e771320df249c85f63c20d006be85070ce988e6111bb356f2030fd2eefc2015303e0823909c107b356

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
99058bf08ba2e338b7acee4164f909af

SHA1
11dc7541bc772af4ce1d68e6d3e08f42b76e595d

SHA256
e4895ba587fc56d3454f5096923cc44b15660ce934898409040ea6429cbb772c

SHA512
1899f903668ee42529310414e5be05cfdad14072cb2601b80a91889c00c36ff35bf0cb81e25849c0c6443cd7a4cab0b34734925cc1196010eb6f3ac97af40080

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9d4bc66a54a023598edd90604af7ae0f

SHA1
5bbb2ee4d7b8704be156a24c1b9b626b7d24f0ce

SHA256
40443bb9ace2548a7e85802bbd1f09b1b62dd99766f9c6a94103b92de152b5b3

SHA512
a01d6ac73ae98433c494e028507840b089c35b0e066638568ae532c95bb61261bb9b97a3f01909dd7e4ad4e262c290d8c4ab54eab0d209ab89dc0b75747fcaf7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d9a5540a4bec41b5cdd02211a2c96788

SHA1
2737064d531073a80adc911933fba651b7edc2a0

SHA256
1de46f2db4ee0fc4e84bd6f4a4589a0ef38e311a9a6bb7cb820ffd5b1d466aa5

SHA512
ab411d0ecd737aa793f12a65ac18b3f86a493facbfddf3471b8177a2f6ac76d243dca359076c7b495da4d65e2a06344a95108495d3f1d8836b772cb9288cb907

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f2c7bd57155c4027d16e000265deb500

SHA1
d67c4728a9e977952d59e93e109148f4ac7b998b

SHA256
95b356a458b2ac3bbc236137d44fbd668dd9778bf33820ae04aa0e88fed8dbd3

SHA512
9ca35ffc2878dfd387c1d175e280a22c1d645f74b1bebf024f49454fb7fcdc23fc480179bf21f60984c632e4d51b61cb4e6ea45c86551023f6fcdd9afaf24419

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
392949a75e0803df195a244b519fa165

SHA1
aea634bece830bfa1bacf3d9602801996481834c

SHA256
67fc4c87319df266b5c3ea554a62b4e6ed45bdf6d1c7b4c1bbdb5170e1efe101

SHA512
dcdbc9e0c37d2cc4f88cf63e70afce95adf8db5602064161c891957b01d1f932171608fe1b5401bb9234f5883e6f501df0dcd7fdd6f33631f563adde0aaa2179

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c7b1b88b883f4f755d72b16afac1f8af

SHA1
ac259cb10a78904955bf858867bfca14095fdc8f

SHA256
77daaa1ad1b5524a7d4cc1bedac173fb9062d36619555a143dd5e8643b95ecac

SHA512
5f9baff90bd825cb606f9b309ff28eac2bc9847242b7a0eea421a4f9ab6722b7a68a6d49fd448fcf8e4e955aa9da2d8c56ce6c944ba21c5dd492462de6ed58bf

Download Submit