94dd3b0622db44abd9b0b316ac492bdb6efdd38b7916c6bab43d33c85a7c47d8

Analysis

max time kernel
145s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/08/2024, 04:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c836592b565f58c4a4734e17cb1aa6dc_JaffaCakes118.html
Size

1.0MB
MD5

c836592b565f58c4a4734e17cb1aa6dc
SHA1

fd7fbb92ee67ba52dbccdb94f06e47aebb509087
SHA256

94dd3b0622db44abd9b0b316ac492bdb6efdd38b7916c6bab43d33c85a7c47d8
SHA512

d1c40dcfff36a2068da432c5139e0e646ed6d9a76c0bf0b858cd73a25a4e3181c9488a520161a32442a65682556e02eb04eb43662bce173e43f36ad00bd79372
SSDEEP

6144:nkclY4UQ6Y/JBDRl3LHhFKB/SKbO6/lsE2HG1qxt+GPaqFZV+rW1bWq:nkclHB66BDRl3LqBZ7xq/13

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
5060	msedge.exe
5060	msedge.exe
4896	identity_helper.exe
4896	identity_helper.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe
5480	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe
5060	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5060 wrote to memory of 1132	5060	msedge.exe	84
PID 5060 wrote to memory of 1132	5060	msedge.exe	84
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1016	5060	msedge.exe	85
PID 5060 wrote to memory of 1680	5060	msedge.exe	86
PID 5060 wrote to memory of 1680	5060	msedge.exe	86
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87
PID 5060 wrote to memory of 2224	5060	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c836592b565f58c4a4734e17cb1aa6dc_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd171146f8,0x7ffd17114708,0x7ffd17114718
  2⤵
  PID:1132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2132 /prefetch:2
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=1964 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3288 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5204 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5476 /prefetch:1
  2⤵
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5440 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5724 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1552,17568985492753691947,10631039967407675372,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2320 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5480

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2972

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3300

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000f

Filesize
211KB

MD5
e7226392c938e4e604d2175eb9f43ca1

SHA1
2098293f39aa0bcdd62e718f9212d9062fa283ab

SHA256
d46ec08b6c29c4ca56cecbf73149cc66ebd902197590fe28cd65dad52a08c4e1

SHA512
63a4b99101c790d40a813db9e0d5fde21a64ccaf60a6009ead027920dbbdb52cc262af829e5c4140f3702a559c7ac46efa89622d76d45b4b49a9ce01625ef145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
264B

MD5
734e722fe8ead5ab974b6bfcc021abef

SHA1
251fec127abac3d484d24ee0cf3181983d7824bf

SHA256
d2ece7af3d93efe2bc808bb1084f582c286acb27c105bd0cf0ee4a560d11d9b8

SHA512
079f193f0f952b20e184d60af5dcb52133e68096f9615fb8d6dba3efbb4086654cebb32ed1bce4a724a39729770ea767925cc7272bfc975ce9b4036f24cc575d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
50facf76ff807a6ab1a386f5e192952c

SHA1
d191412dc3324af531b9839391e4947c39ccdc3a

SHA256
33b5b17d9b9c9a514e26ddf39dde9b1c8bb0b205fbe387aee48945cfef4030c6

SHA512
75fcb8dc729c4d8911c369da55c28164d09ddb3712233b15a0acf452bac91842f54d058873d52ac78367b11eb9b549629e4cc9e9fb50659b5a2fb1e0768fd8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
8b0afd8c1737afc917990f0d8db7c47f

SHA1
940a3df5e26ef053f573e51938d367142f6b86ec

SHA256
57646a410767da1ebbd48b66d9adbfa5580265c9bd9f148ccd71fbbb7957fa4e

SHA512
439d33576aa87bc3d49ff524ce5f6ef860feca39ad4a52eb50725d5b4e3d58aa290fcbc34e8370e37b69920dd5ec01201b353d592014eeaa43f0aacc0280c328

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d0de6d93c8dc374bde08175837c2642e

SHA1
05ba8db4e35aaff7a031c451fe0987bf636635f2

SHA256
484de416c5d68d82f29f9458ec1c3a1a55ea78f98fc07d1aa053b07b6abffe8d

SHA512
b3fca13dcaeeef6dd3bb1350ba7b1613a5a922cdaac554c5c00c4b5ec258de87e4510743e1cbfd005c9aacd5d6aad344db95aaa82b0bf2531c74e45fd2552bb1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
120e37e77c39a68206bf7b160a88d08d

SHA1
b257d2fd49073a365bf82c2f3f104a8f6402a8e6

SHA256
b4c6ee4846784c4aabe60d08dc53f88862b470f256b7314127dc5e5bd66d062b

SHA512
0024cec64e3f59b4cb3c28f312c0c9e1d0d43d45c665621fc6cc0910f0ce12e692bdaea680f5af4a6f17ce5e1d0a153b2b7728c0229a5e8c1a5832d9582d47e8

Download Submit