f05722820e9105b4cb22d42554a75c897b9d4b36c793ee1db3b21adae1a2a38c

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-08-2024 09:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

aa71d6a5359ddc28806783c965f3eaa6_JaffaCakes118.html
Size

135KB
MD5

aa71d6a5359ddc28806783c965f3eaa6
SHA1

f5977b5226a3d88c11997f4e0943279566779000
SHA256

f05722820e9105b4cb22d42554a75c897b9d4b36c793ee1db3b21adae1a2a38c
SHA512

868975162238ceef6a3640889a65ff3a0ca45640cefd7451755cb298c773708be9ba3324360d7cdb6d4639c8aa6bbfc1e72e6c1dfc7fb6fcc8b7ae1a628d86ea
SSDEEP

3072:9cL+Oh/SSodbnckaYJNQMcZfgf5Cqh03+RqFHjHCHQNTkE6GH1rNDESilW3Vi2FF:9cJh/SSokZBJilsF

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe
3120	msedge.exe
3120	msedge.exe
3536	identity_helper.exe
3536	identity_helper.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe
1964	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe
3120	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3120 wrote to memory of 2240	3120	msedge.exe	84
PID 3120 wrote to memory of 2240	3120	msedge.exe	84
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 1288	3120	msedge.exe	85
PID 3120 wrote to memory of 2488	3120	msedge.exe	86
PID 3120 wrote to memory of 2488	3120	msedge.exe	86
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87
PID 3120 wrote to memory of 3644	3120	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\aa71d6a5359ddc28806783c965f3eaa6_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffc86946f8,0x7fffc8694708,0x7fffc8694718
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2876 /prefetch:8
  2⤵
  PID:3644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2120 /prefetch:1
  2⤵
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5192 /prefetch:1
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4532
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4812 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2036,724764862065945603,10860759525837084555,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5468 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1964

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4672

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4860

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000d

Filesize
21KB

MD5
dc52475756e1c2cd28a642483362cfea

SHA1
f3ac327ef03dcde06f67e14c832fc8192720c5ea

SHA256
101e409217ecf85114a73cb222e256680fed2c01985839796fd7ee33abba9f2c

SHA512
51d10255550361a1d3bcb0ddda3402e7479c7babfe109982d6fd0143df08699ddcf6119c09b6f3ba357419a6d2828815c750a362c67a7e10b3159df8702af4a8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
67KB

MD5
b4b711f3e747704ffe02b49791ce8cac

SHA1
ac7ce4cbd3c8ee66e3c8d9d209c1352c160c3b89

SHA256
f65bf40e2f0ce993b54772f703f72d53f0fa925457346fa8ec2031879ffa91d1

SHA512
b738deba57337a9147927f7dd35eab7c999dea6d2ff11f57fdc2e5b6f64326028a54778886548ba128a3f03ee333cc9e43de5162d8b578b85c290626577042db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
84891a4320554f3c8707a32034ead277

SHA1
c6985d75628e88205d658a875e27af0fcfc10a7d

SHA256
6f01a5498c7259e5c153d82e0b0640d81af6d06eadeb925f3ad1b2ae51cd9ab6

SHA512
7883513784da922bafdf22b278cf4a00acf4433e8a16281579ea02c34f7eeb7fa0c9c9dc233a32ea9a5a9911ce0c039325f3d4902aecda75bc672a6d9452ceec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
865f46033b6959f388d7b8d3c763d34b

SHA1
b6f94551e5f1a22510f7eeecad0a39c16389e85a

SHA256
c09fe6c811c774a152683cbfefedc9e615aeb7134be9216ae9d9db5e16526558

SHA512
3183fecf70e120318c0912f1df617593b46bd87f241f31d2710ad57b8248347548785d39856047763d6b5e978a9a10b47a7f6b1539313a16555d7dd57e5952c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
e7ee129eef38ad2736a6b39a84bcabd9

SHA1
da840a68b74cc9ae4e89eb5af4d195ae703e5a4b

SHA256
8b2a7fc315c4650af8b7f166302683bdfc7b337680a420ff62b00784ff9e9c77

SHA512
eca4d9a4b20bef079890f0abf5f46d4cf399562989037d5950d5d1b2bf7adef02c4bf4e0e14a25008a13510b0624a9c0bc6a4738f1afcf9a8ffa10e68aa7c5ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
31cc3245fbfa2c165b56e1b4a88d57a7

SHA1
d0866cd3b44cf61f01e6cd220be5bdf6e49fd50b

SHA256
a508bc37e640cd3f18028b8e6fe9ab42b4ae30e321965b57fee6b0274d4880a6

SHA512
c0cf0b8fadc06443f01ea11cc97f16dd168f8852338cef3f051a72bc99e2181ccd780da9ba281f6c559b03343c44fa3704136aa22a515d6b9ac1693644d507dc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
da727c54c75760d6f5f1970029dbf2d2

SHA1
111d3ec792972e54cce8212f2f183a0402071f04

SHA256
5036391a0f3741dcb5f8b7506409eb666bb528aab395a02deb330356661fe215

SHA512
46383fccd691ea7e19d0975875ac4f65d1798ed8bc83ed334f2770f6bab4b797ed4d4bf854532ec7686f9016e9d5bc71834ae04607c7d03277c2c306500b9695

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
50ea1db13928d5cab9bc97342944b87f

SHA1
f7bea2a605214936079690ec6782bc4f6b049eb4

SHA256
f23ea210ce28d2ea0bbcf22e312ed88d2309440bf39825d8665fee060f6caf81

SHA512
74995d450996c0e9cd41004d02eec02a4dd036023c0c615c4b6d85e0f669ff48ce1bdcd58600cdd630138d4e2de67185ed11ba4c06709931617f4c384e65fc29

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
77f295994dbbb19d4b8688155a0d5de3

SHA1
b3bf9e6f5cff0ee8374dee39576819a400f5dfec

SHA256
93a2e86b30c22fd018f60eec706a896809567a47324874cd5bc07de8a6848175

SHA512
9b0d39ae56a86e035208e0c53d6efe5457fc8e77ed8d12a6a610cdfa0ffa27ef7567eaaee040ba1b4350bae668b109b7df3227ce4d6bf524023048a4d4d5a97b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
826f76d2a83de5c47a1e31717de36d40

SHA1
5b442d5473dbc064cccc740d4cbaab4bc5c88811

SHA256
dc88aa9fe11b832d89ca812511f06529b3b2db6a2c07422e82e0739bb929d268

SHA512
20a5c97794bfd183215d30f68de04e6eb6c70f6ec539308697e1b25ea61ecf35c9e60443ed761c119076cdd3a18017978f57db2fa62e929d3e4d516b53c05911

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
7fdc45bb287fc87636785cc452d6f531

SHA1
8b6f335d8a6226994d663bcda2077ab3e68cd403

SHA256
202f746f47a647f26c5d63f2ebf51cda0ff5d80f136f6e33ab386e7475010acd

SHA512
ed73808150b5bc403e50f587fed6e33acc2d4544b83ef16454b2477fdbe030405740520ad0c6a1fad32fe35c4807cbd20ccbe885b8a809a14f6e5c807f4c7484

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
01a36172086fa9ab787b62a03e80511b

SHA1
6df05bc92150731850f85ae1c70d822699130807

SHA256
6230cde49e85fad3b6a536c5d72a1ecd79fd8014a30d88c346eda7e6961e1678

SHA512
127bea61e83eb01f7beaf96ac6c11e493747fc3b4099beb0812935f8cd10b40bcc5c458d1679401a5f0c7106dc5cbf7d44e8bc5f574f28cf31454782b5bfbd16

Download Submit