90506ea18ec6ac940bf5560fe829a41db413fcc313d032536755a205a9865624

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
20/08/2024, 05:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

adf5b8e76ea70b1f9d6919a275852668_JaffaCakes118.html
Size

57KB
MD5

adf5b8e76ea70b1f9d6919a275852668
SHA1

d91bfd60d8b6fc0dc4e6f9ebed1dfa4ac88aa701
SHA256

90506ea18ec6ac940bf5560fe829a41db413fcc313d032536755a205a9865624
SHA512

eff5983a4915c55e3688e4723cc14cc889997069d5938665b5125b55079a7f450847af23f42d484bbd2acac84bb133bf450034a1799e3876f6a044fc0a9baf05
SSDEEP

1536:ijEQvK8OPHdFg1o2vgyHJv0owbd6zKD6CDK2RVrofgwpDK2RVy:ijnOPHdFt2vgyHJutDK2RVrofgwpDK2m

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4668	msedge.exe
4668	msedge.exe
2196	msedge.exe
2196	msedge.exe
3604	identity_helper.exe
3604	identity_helper.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe
1988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe
2196	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2196 wrote to memory of 4396	2196	msedge.exe	84
PID 2196 wrote to memory of 4396	2196	msedge.exe	84
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 2736	2196	msedge.exe	85
PID 2196 wrote to memory of 4668	2196	msedge.exe	86
PID 2196 wrote to memory of 4668	2196	msedge.exe	86
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87
PID 2196 wrote to memory of 2452	2196	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\adf5b8e76ea70b1f9d6919a275852668_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff8078f46f8,0x7ff8078f4708,0x7ff8078f4718
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2312 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2904 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3320 /prefetch:1
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4716 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5624 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5788 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5932 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6432 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:5352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:5360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2224,5285977160870846273,16226333785684371083,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5084 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5048

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3876

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e4f80e7950cbd3bb11257d2000cb885e

SHA1
10ac643904d539042d8f7aa4a312b13ec2106035

SHA256
1184ee8d32d0edecddd93403fb888fad6b3e2a710d37335c3989cc529bc08124

SHA512
2b92c9807fdcd937e514d4e7e1cc7c2d3e3aa162099b7289ceac2feea72d1a4afbadf1c09b3075d470efadf9a9edd63e07ea7e7a98d22243e45b3d53473fa4f0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
2dc1a9f2f3f8c3cfe51bb29b078166c5

SHA1
eaf3c3dad3c8dc6f18dc3e055b415da78b704402

SHA256
dcb76fa365c2d9ee213b224a91cdd806d30b1e8652d72a22f2371124fa4479fa

SHA512
682061d9cc86a6e5d99d022da776fb554350fc95efbf29cd84c1db4e2b7161b76cd1de48335bcc3a25633079fb0bd412e4f4795ed6291c65e9bc28d95330bb25

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
792B

MD5
c7a4e7c6a625b7fab64ceecb9f74787d

SHA1
781687bb887d4f66172458b9d04e8fe8f094eb0c

SHA256
0bc820451913f54d02847c57beb88683ffda5533e36a6a09504a64d69c238087

SHA512
3eb4926511cf89b17d173863dc5f4d672e15bf27915d410ccb1c23ab43289a86ab18693f84eb1b09013210eb018e8eef0bfb19b48d179623f2bda4643e182848

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
52158eb4f061883d0c939a46c2f10e6c

SHA1
a4dd74b667cfc68f7e79fa776df97932746805ad

SHA256
9823abe5944579d6912e4356f7e23844754cc0bb288e1e7322d1fa7cc2807a84

SHA512
60f4e915384e3cf21c17c72a0f08912d080108ac60ef9987e4350f13aea7518f642744021a3e1700914caf50b7e18b875fd9ba3bf38d11c8be56d2c4a4e4081b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
70f87f923f7a5defae3cb850766846e8

SHA1
bf06ab76e32e575397d31dbf1dd0fd1218fa67f1

SHA256
cae1cfd698ec31abc728a43143245c1ebb10ddf5b1f0014e31d03c0fc979f99f

SHA512
f8fb47f3d5a880e6919cc2ac0e0d6f2ef44377316b490700cf56f9f16686da99a477fea1d5080ea4121d953690e077d4a781e5a719c1c57b4d4a37d6fd233de6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c0944d3b097d9bf950dcb042baf2d82c

SHA1
2079286d362edecb9f301a412d651dfb0a721ec8

SHA256
50a5cb054a7fcee8cde30e440878ae20db856dcbfa257f16a25b772d9ddefe87

SHA512
e74b74eb599c2fd20d7391c9199aa3c9eba1a6d5326c603d2a40e6d67943b0667c44b5c189867ee27e310e9963066e74a9be0fb2d5d3ece59e813e2c2cd790ec

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
df08fdd45d8af948c783f6dacd2b5c67

SHA1
141fcfce2fd58a1218d50306e9d168408d99694d

SHA256
3139890ff2458cb9666e69ae6a67e4572ed1fb0c3c71cf0a1876fa2024cdc0b3

SHA512
d4293f9f1ab9eaec0106a689e941e112a2d01bde602ce2f9f263f5abd088252cc0bfe73cd80916f3d94fff9f71230d9d4f26cb642d926fba4e3c450c63c8065e

Download Submit