6d183a140661596a931caa2c154fe8e6a88c497a6dd517a678d8029068806135

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
18/08/2024, 00:50

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

a4c292e6c3aabf6a66493a91bcd0d2d2_JaffaCakes118.html
Size

138KB
MD5

a4c292e6c3aabf6a66493a91bcd0d2d2
SHA1

63b49e607c0d09634e4ae25e96180952c6701044
SHA256

6d183a140661596a931caa2c154fe8e6a88c497a6dd517a678d8029068806135
SHA512

a15f819e755847a0a3fdff624def954e82e5579ca96ad2b4767f420e91da53da6faf0e4e35c78ef0d2baf25ac4aabe3c0b986afb5dff5d983c3fb7dcc021815e
SSDEEP

3072:1Rm3IQzj9bF71pvO4ebib3y7hJkWpTvTW585IjF3FRN3rWj:sP6Zb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1384	msedge.exe
1384	msedge.exe
2784	msedge.exe
2784	msedge.exe
2416	identity_helper.exe
2416	identity_helper.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe
4172	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe
2784	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2784 wrote to memory of 4936	2784	msedge.exe	87
PID 2784 wrote to memory of 4936	2784	msedge.exe	87
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 4116	2784	msedge.exe	88
PID 2784 wrote to memory of 1384	2784	msedge.exe	89
PID 2784 wrote to memory of 1384	2784	msedge.exe	89
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90
PID 2784 wrote to memory of 1508	2784	msedge.exe	90

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\a4c292e6c3aabf6a66493a91bcd0d2d2_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcff3546f8,0x7ffcff354708,0x7ffcff354718
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2320 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2940 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5076 /prefetch:1
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5536 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4076 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5756 /prefetch:1
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5632 /prefetch:1
  2⤵
  PID:2608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2124,10448553783575960987,15124948918006167582,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2736 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4172

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4736

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
9de06a2489487113536794f592b907fc

SHA1
508faabd0ca985558545e0a83e5d824e450613bc

SHA256
46f3d9dbfb960d744b9be920922e4d59ed6443d0d21f33729c5dac1a0336177f

SHA512
bd830c64b382b4bc5909f383d86431abe487e9886e742dcba6f06208034f11842cf0a9bc7a4fbf689ae6b50d1cd7905ac67a8071dca802f4576fd6d50b19b056

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
537df247085a84fdbe6582ee9c97fdc2

SHA1
a5ed557e75a64a4e6ad41aecb62b7fd19a4c8878

SHA256
7e069216ee93e53e9f696ad4f8b70f162a8de492edf4acb6d12d2285d307eff2

SHA512
7122db24cf85079dee0d5cae9e0bd699557458354b868c0444c8fffc8ed763161127aa7c81542b3e9d93eb4ad7ba2e96688747eb056dc52f65900bd3cfed7d57

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
5081c8ba9f1113c11012070eb0b2056a

SHA1
870f0d56aefa9dd7781d1acecf734547908fec0e

SHA256
fb2c8c569f17ec77d1476370582a25e4e4e1308596dce3c5220e377caac78539

SHA512
b9edf89e55af9eba8e1b0f75f8c4c8d51887b1191fb7a69f3dbcd417cb610c35d67e2e196ef91b305e769ae478cd1666cba04bde400d7739bd203873f05fdb65

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
8afd3c5016689e983d5c308523ecabb2

SHA1
7d4154bf153842eb73d09c266549d5e5ac5a3a7a

SHA256
70aad215191c550a2dc7e7659623a6ae1c27adef511d0929e1442e1bf77feb7d

SHA512
835ef1814a5c669f6f6fff98746b07e0e5cdb6d5fc8312b59a258b14b6a300f7a576056ebbc159c4b220a8313e0d5daa6c4206194b6a8bad1b97bdbc5524351e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
6f816ac325199f41d91e60b3635f83c4

SHA1
d28db569fece3770ce18d6b87bc8f1ebafc09344

SHA256
12093569efabfd487bb9724c05a3c78b30ddede8cac316f1a5847afdf1c88b95

SHA512
d71bb8472c559281dab3c3919b7b83a27dea2db0315324968ba88ab592862e504cbcc6fe44b76f7c4fa9b55073c196692c4c032783faed7fcadbb353d13ec532

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
9e3b3524390519e2223412ad3ecbdcd7

SHA1
91b1f49bffc7e81710b35dc588b6c153b72c396d

SHA256
c397fa0dc5b43bdc63651f0553cfa0a0c2d5aeb143fd7d928fc254e3fc1d646e

SHA512
02b6c17582a710644768d25792f3d1db109c802acc93aff112c29444574c48dd7cb2d0cf34683918018447be4973e94d6b259e6bdb65868d431ef619fbdef12a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
b32e776c6b56073e6ec45caf8b945d09

SHA1
25a38413c63e292e0c95fd17bfcd9fb5ac611c5b

SHA256
453546786e4a6f6a688ba56b9c905d09274ef598eb1f69dc107a16b8d5fc5058

SHA512
6eb88b727d3a1458f3f22b18b33b8b5e3150442605ad02fb1fd26c84d64d628ed7e5a964b5f5b796863432b7b68b42678ffdbea185053cec59eac62bbfbe5932

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
c05cfc108f6a42fe7750086072af175a

SHA1
5736996cfef5eeffc59a3ab2cec19ec439471553

SHA256
4c4a1ce4fdaffb1148340bde8ede351996d7a2701991ec00ffa07799a8ca7913

SHA512
d6985f81a56e2eea71f1f27970eba9cdb2babdfcc4611d4ed612fb21a99e18dfafe1373b7d86d17c32e1db89ba1c460151164830ea15eb954ba7e6c7b9a20e37

Download Submit