c882402f70873cfccaad9e7b1f10764948c07dcf8625874dc03507373016f863

Analysis

max time kernel
147s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
14/08/2024, 14:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96729a889f281811c656430bbe65dc0e_JaffaCakes118.html
Size

57KB
MD5

96729a889f281811c656430bbe65dc0e
SHA1

40ce010c332ecb336bf740d46d3d3368e39610bf
SHA256

c882402f70873cfccaad9e7b1f10764948c07dcf8625874dc03507373016f863
SHA512

bdafba7149dd9893a75373c19276f378592422a39e6ee4c8d1f52695c0ecb8a97f0305d411efa27862a2f459250a5c78c7059e207f5e4a552ec4682152e48d62
SSDEEP

1536:ijEQvK8OPHdsA1o2vgyHJv0owbd6zKD6CDK2RVrodYwpDK2RVy:ijnOPHdsR2vgyHJutDK2RVrodYwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
3896	msedge.exe
3896	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
2616	identity_helper.exe
2616	identity_helper.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe
5816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe
1328	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1328 wrote to memory of 4260	1328	msedge.exe	84
PID 1328 wrote to memory of 4260	1328	msedge.exe	84
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3384	1328	msedge.exe	85
PID 1328 wrote to memory of 3896	1328	msedge.exe	86
PID 1328 wrote to memory of 3896	1328	msedge.exe	86
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87
PID 1328 wrote to memory of 2872	1328	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\96729a889f281811c656430bbe65dc0e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffce26946f8,0x7ffce2694708,0x7ffce2694718
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2080 /prefetch:2
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2132 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2724 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5552 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3340 /prefetch:1
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:8
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6548 /prefetch:1
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4940 /prefetch:1
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6836 /prefetch:1
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2076,8320791156241387887,9872641576070909018,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3148 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5816

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1512

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Filesize
328B

MD5
26d03e6fa4f94fe8d8abc61aba0d2ff1

SHA1
72ee952e6af7a34e0f013b6acee633cbfe22ecd4

SHA256
2cbd89189bc54c2f21061ece512a2e5b71faf16d67877cf609862a9c1f219be4

SHA512
eba57fc9384128bd6bd1687a9a67c8af635966294669e4dfd23445fb88bb4085f1acaccd6241c2c3fa6181f6009baee1464cf4d228a151e97081c6675d6a2510

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
c78c30122aa4ddab9bd20f12777a5dd1

SHA1
977ea7451bb39bf09f37093beddeb12eca5afd27

SHA256
a46f5d93ec1a7aec56660e02729ce0b0a713d588893279cae4bfba01839b07db

SHA512
b12736031558ebddd83c34e580aa7db1f59ab1cd09afbe265629b42396e592b64c7be59f2261e9e91cdfbba966d1ba7fb035dec7a550f1f254492ebf59ad8940

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
107774b52721a5994a4ae4596974e2e6

SHA1
7771b3bd0bd6508773c871602a0b832b70e6f1f3

SHA256
e293cd437744176670dc32839df3347ef2db3fd65c21f9dad12cbeaa92d291ec

SHA512
0500fc6c6e00ad4d2af2fb653f63e5ca3e85404757e0e97820ac37ee139908bd7e45051fd527e5d299aa0bb137b3733f310ccce0e34f8a594cedb9a1a92870bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
def7bdbbf8c21b648e6da2d12e275373

SHA1
1a3a8bc01fe28807c8a5fd3b0bbd1302ceffec4f

SHA256
71ddda3dac3d7b648cc3db809337df3c76a9c60c83e306b65cb24bd6ada75136

SHA512
4f716eba4dc96a0eceb7f7169fb030ecb3ef8b39d34e2fd273b1f0e2877d7459b9851809b602cf89e1faf035a787decf19d140c324d7337984f0bbf8f9ecbffd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
f866bcc870afbe9f948c9c0c7e4f78a3

SHA1
5ad9bb8f9cfad3ff924f4e0305b19fa9733aefee

SHA256
f975ed9ee8872d167516a270895c6bdd0afcfbd2593d33b05a5b34d43fc94fe0

SHA512
597ced6817872a342e2a3ccb52eb1629f0439730c4e068576a8c8aa9b5b8f4bfaec99d43161938c988aa19c57e8c3a21e2ce2320c278868ee6b2266fd793d29e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
bebb84c9a8386ca4774d0124a2b156ae

SHA1
e6253d53a05b684914387cd0dca89c1c8a0b2f93

SHA256
b74825623890660297b98ad0a67d0229f3b042551ba8b89dd57ec5a96151d5ab

SHA512
76c2683cdad1d00f4da17fe6a7e72bfd5eb78ce92f17ccd2886370e1aa7c8f7584c4f2e8bc01c597d9f87d9fc3cd243a4ece507f833555640fe49ce2c0978506

Download Submit