fde6e825ff774ff7e448fe27145bc6d5d1e6b19a93b7682c6e5b3f0b1513262f

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 08:35

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c2a2a73860222ef1ae3f41e71ce82c3e_JaffaCakes118.html
Size

190KB
MD5

c2a2a73860222ef1ae3f41e71ce82c3e
SHA1

19394f72ff5aee592e0244c27ba97f3dbf6625d3
SHA256

fde6e825ff774ff7e448fe27145bc6d5d1e6b19a93b7682c6e5b3f0b1513262f
SHA512

4f27aac8bb39ea398d09e5ce80c9b8d6645a88d39f898200be7a3d0a4829bb38b0e9a79954437e2865d88b2491267277d696a5c45354b0de7450675597110e83
SSDEEP

3072:CcgRWCZY9wIP3lFEBZNKDjEgORjlIlUlkOxYO42OalDCv5C+zMMLMlu39hZ7rW:CcgRWCZY9wIP3l2BjKORjlIlUlVr42DV

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3164	msedge.exe
3164	msedge.exe
232	msedge.exe
232	msedge.exe
1176	identity_helper.exe
1176	identity_helper.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe
232	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 232 wrote to memory of 5100	232	msedge.exe	84
PID 232 wrote to memory of 5100	232	msedge.exe	84
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 2236	232	msedge.exe	85
PID 232 wrote to memory of 3164	232	msedge.exe	86
PID 232 wrote to memory of 3164	232	msedge.exe	86
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87
PID 232 wrote to memory of 3676	232	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c2a2a73860222ef1ae3f41e71ce82c3e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffcb34846f8,0x7ffcb3484708,0x7ffcb3484718
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2756 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3160 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3176 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5564 /prefetch:1
  2⤵
  PID:3224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5728 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6504 /prefetch:1
  2⤵
  PID:3812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6424 /prefetch:1
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3384 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2120,7381133948526528651,4307105743757194310,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4892

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2920

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
111c361619c017b5d09a13a56938bd54

SHA1
e02b363a8ceb95751623f25025a9299a2c931e07

SHA256
d7be4042a1e3511b0dbf0ab5c493245e4ac314440a4ae0732813db01a21ef8bc

SHA512
fc16a4ad0b56899b82d05114d7b0ca8ee610cdba6ff0b6a67dea44faf17b3105109335359b78c0a59c9011a13152744a7f5d4f6a5b66ea519df750ef03f622b2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
983cbc1f706a155d63496ebc4d66515e

SHA1
223d0071718b80cad9239e58c5e8e64df6e2a2fe

SHA256
cc34b8f8e3f4bfe4c9a227d88f56ea2dd276ca3ac81df622ff5e9a8ec46b951c

SHA512
d9cf2ca46d9379902730c81e615a3eb694873ffd535c6bb3ded2dc97cdbbfb71051ab11a07754ed6f610f04285605b702b5a48a6cfda3ee3287230c41c9c45cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
23KB

MD5
a0423f1305547bb6b8f5a4fb1a9fc2d8

SHA1
092dcf1fe57e6bb53821eb754e04188ee70602d5

SHA256
6add651cb411ed9ce9a17883c1522920a6ee3b4eb676f5b411e72d1a5e7de6e8

SHA512
b8487c60b40d332e562cc5d4fc7c515e3b3c2c82311700b788905754c1376ce6f0da650583545a4691d51f04ec5da0c0204997214d167c85b788d4c85236c4c3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
49077b89b838743adee9bc8975744116

SHA1
0e80ee57a3499284a78c282fd73afb3d6ede2974

SHA256
893987810ad69d8e3c7a5595cd056a5c884dd1a1c29a1b3e79152edec5c52308

SHA512
9713876fb25f0078500e0b207949bd6dcef3a6e57290852bdf6a73275d8d587c044a8463aeb856e30a0221d6b03bead621fa51661efbdffeec35f88467bdbdc2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
cb091ff9830f6126eba7d8105e51f467

SHA1
934322b86a867930eff8ecc9379884830383a173

SHA256
dd77dc655696f642185a2347879b53467056a52e1dc46eb70141e7790a84db2a

SHA512
237eee21205e38587dc3532bbbb1b5c1bef9886cd8c227a2572872c0a5f2e882324e3e1670755a4d6a90170be13babd3ecd6be2383362c95c1cc309ca05a1cbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
5a61245ddb7bf426ec97b08eaab4ce94

SHA1
a02e731ffca10b04355cf11dc4597f5bbbe4aecc

SHA256
b94f185d5f19eab68e75d5fc454a8e921a00dc5bfde66417417b4902c8e4435a

SHA512
e5d674d31676911e75a1ade29ccee2ea27117f05106221946240b9e715a2b4f42fcd3678465dd92ff7dc2a077ee0b22f3255f175a76c9aa14837d80c0107fa1c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
be7fa1de379fbb55580b7a2a6b689b8e

SHA1
a58694c4e919cc24a96f8d6c81fa2a3a47c2b81f

SHA256
99e334b413d379c893ae6d8f2219b2f95e1f2248aa29f8d14ad8ef0d9e001481

SHA512
8ad9ffa75eba1cc3cc6423dfb86c0ba2d77a92b5d23925699f628e8627944180b1a2b3288824df990e8146c22dfa2d01896dca9384a90b208e61417129b4b3ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
86d789addd633b83a09e186f467c7e4c

SHA1
4d368e1981206ac7a3ba54755b20f618eda0f2d0

SHA256
112f65299c8e75b9833c3ea89a4f760fbd7b72de1afab2f3111168e8c16c3e07

SHA512
a87a00f52bcc20244bd0e39cbcdb23eb0d636e45ade7bb31597f4cae7e140d68b640b21e3d3a88e23ede8deff333be2da70bd73b321312c2c7cfeb7c0e5f9bd8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
24f9648173c30ce95924cb48a0d0d63b

SHA1
e41cab6e4e992c90ee23309f43c73ddb1f961d97

SHA256
92267683bddda683239c547fe4c15c083c02cc7a2dbce358a3a207809252f249

SHA512
5f95024cf2a5afebccd2213415fdd21cc82a651e7c8cc1bd8f0d13d6dc854b8c0e6c877c03d31e1c8964ebf38232be88ce1364505913464d2c77ccff9c274200

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ce6cd6e07b3d4fce53433631b6899389

SHA1
306202bf4ed3fda56a69d8fdb6a4c5ac424a4341

SHA256
dc51d82536f136138432cd246ea7e19b7359c70255060b39532045aaf6688e9e

SHA512
4ce490b77aaa1999dd8376b88e3f94b2cd2f042700f234c99e0d1109ee34a252cfce12908714b70ee31ab1069a8d093607215ff8729d20f6c4459195dd1dadc8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0212c5b7b5ec0fa9896cfa06d1bf751a

SHA1
7b3c92f889a0dae799f9935ce2528a6049b07436

SHA256
b600d9be566d55ff78bcacb53121a339eb7e8bc29d3d162e47f8a87276aa7d8d

SHA512
65f0e54d6386fa5cffadbb4eae6e5b9a5df6ede047e8f3bd8183786b933cbddfc4ac5173caa0012d08a6ea2d4407cdadfa9fcc31f002225afd8b240644556bc0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
ca88d75c1a6650531821693304caf60d

SHA1
a7b0bc849ac8605b62bd168b12c93e0ebd82c0dd

SHA256
2c8c3b8e1cd0ebd04e2cf38645240eab8c6f2ca308bdeff7ea6dc52342290672

SHA512
79ffa17ecd1b0ba1f12cede432cb2ec00898104832268dac0f9e28254ed195d4132b8a945b398a8ad5af900a0bc47598948aebba66cfe316f411586f7ea8037a

Download Submit