57e3e6486df1f0c0e9e5844109cdf8f44dd7145a066de9f817f09df383ee951e

Analysis

max time kernel
145s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
23/08/2024, 16:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bc8ab1450c30bbaeb5f3e1b829b3fb66_JaffaCakes118.html
Size

37KB
MD5

bc8ab1450c30bbaeb5f3e1b829b3fb66
SHA1

192a7b2b269fff5b3c99441eb87362ee97f50ff1
SHA256

57e3e6486df1f0c0e9e5844109cdf8f44dd7145a066de9f817f09df383ee951e
SHA512

87354610ce836f9aaac18a79bf097d681352856db74b1fee5beff8950d5edc8556884e6d99a2a6703e4666d6d9d6e05a2446271f63e22bc69150286688a39c92
SSDEEP

768:UhBLKU1mE83cm/jZWtElweK3cEqx42XSuR:UPKU1mE8Mmt55EqS2X1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2460	msedge.exe
2460	msedge.exe
2924	msedge.exe
2924	msedge.exe
5608	identity_helper.exe
5608	identity_helper.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe
5576	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe
2924	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2924 wrote to memory of 2780	2924	msedge.exe	88
PID 2924 wrote to memory of 2780	2924	msedge.exe	88
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2760	2924	msedge.exe	89
PID 2924 wrote to memory of 2460	2924	msedge.exe	90
PID 2924 wrote to memory of 2460	2924	msedge.exe	90
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91
PID 2924 wrote to memory of 3896	2924	msedge.exe	91

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\bc8ab1450c30bbaeb5f3e1b829b3fb66_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb271d46f8,0x7ffb271d4708,0x7ffb271d4718
  2⤵
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2044 /prefetch:2
  2⤵
  PID:2760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2868 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4892 /prefetch:1
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3784 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  PID:5592
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6964 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6248 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6472 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3408 /prefetch:1
  2⤵
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2016,15048654351819661304,2196082150924443485,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1688

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:224

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4588

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ab8ce148cb7d44f709fb1c460d03e1b0

SHA1
44d15744015155f3e74580c93317e12d2cc0f859

SHA256
014006a90e43ea9a1903b08b843a5aab8ad3823d22e26e5b113fad5f9fa620ff

SHA512
f685423b1eaee18a2a06030b4b2977335f62499c0041c142a92f6e6f846c2b9ce54324b6ae94efbbb303282dcda70e2b1597c748fddc251c0b3122a412c2d7c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
38f59a47b777f2fc52088e96ffb2baaf

SHA1
267224482588b41a96d813f6d9e9d924867062db

SHA256
13569c5681c71dc42ab57d34879f5a567d7b94afe0e8f6d7c6f6c1314fb0087b

SHA512
4657d13e1bb7cdd7e83f5f2562f5598cca12edf839626ae96da43e943b5550fab46a14b9018f1bec90de88cc714f637605531ccda99deb9e537908ddb826113b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
110c272be4893cfcc35d717c3f17d7d0

SHA1
9de3271026cd2dc0f415fbb5defb201104713f0a

SHA256
d88b2b882e116a236ca20b20f09b36b36760ce68b54539429500a67fccf56c1b

SHA512
7cbf2c396098c02b34293b2d8a9af63ae8e662878fe12f4d79d44acf59523691c33c140fa6e5faac91ccd52fa1ce2937299c5f928b264da040d24245e3284b1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
941af557a64bce430a990db97c4b50fc

SHA1
8bb0a4f83b5ebad97f8f2594662fd545bd8c8fd5

SHA256
00fee7440cfe3dcae3fcf54258ab3a8939cd898f8e62564aceba2c238225741e

SHA512
a8e7e4cce091a31fcc2505524f7e5eb219c8fef687afc5217b00e8c3b97445205098e6b0e7fe058de46728f46ce218e0eb313b4cfb10abec71e9ba85a1409888

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5f79a5eeb53a2751c51eb8a2c7aca4d9

SHA1
7573166e82bc04c6134d05fba38dcf9697ddba0c

SHA256
4162f7064b40a395c568ace83b21d81996e4cf1a32fa17993f06e247846ba84a

SHA512
69c9a367968dda1790a96916f214d995c96dc35edfdeb44721aec87ec83731a4494f351d94b7c62f518d31c3f6f22c9afaba9da2ffd0408180feadcd73f9845a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2eef17b14af122150df806952638466b

SHA1
7bdc4f25bcc0e7d82259876097b0764003978adb

SHA256
801456525880269073d20682685910e8591c058eb4ee763ff38932ec82b12a9d

SHA512
08b5437b5f843fcb6fa2afe2e799d2d8df2d754fe09d0f12b596e91b2af68575a541083d88317d78d6cf4545b2f804a3862fd9c60c3d712a80d37eab822c4b0f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
f5df6ac88b2492c54dc26aeba7526c1b

SHA1
756ae10c714ba837c40824601344a8b219f24349

SHA256
bcfb3b88eedb43d14ed7879f86a4a8186703eb866e01c87b259a46cc944dd757

SHA512
504b784d2be8853783d6ec127d13d4b943853d42704097fd38e4d2fe2266ab583a329a887b61945eb2e141992761599735798bb56971d9b3f81aae69ff1985fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5094f8e8c0076fd2717a7a17c556bae9

SHA1
bf894d02770340c42fdb81d0fb1e54513005cf83

SHA256
15f177d1f949d105f4d5f739c198e5671abf155a749fb30d12c64c6fdcc8e559

SHA512
b93ec45fc30732ca9ad484adeadc84b5a276f33b37fd4bfd444a314dccc3ff17f386b95a7e392ecaf77ad2c04ef6d517b803024c2913bf6f538c6e6fef2dda90

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
51995bd2b2415395c7947d891ca45cf7

SHA1
2aeb82f236ffedac044e3e6ad4354b476d2308ed

SHA256
2ca9a954ce03080a976454281be47f7db79c0723bf8ac7c0959f531323d0abcc

SHA512
9410ac055e14bb3a4adda1e0e73bbb06bf4f43aa6fe29e04c23b0467d2416c4543e94e874de921b21f0a47c4cafa0cdf27251d35af64ee6e6413b5c3086ae4fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
7650e0cb959ba425ba440d8928f05a6a

SHA1
48dc4ad680daddfd48a354b8b874a6732bf7b7cf

SHA256
7f258f13fa65c2a924e049e29656c94e057b5e7b38ecf7566f2d44196c2b30af

SHA512
66de71108407cc3e7ce0a642f9423c17ece1b25c4af804aafe8d3bcf7d088e6a892fc0ea0c0765a64e31fd01e5880c258ab93587c4bb50c8e07a8a3520803041

Download Submit