823d168f17dff3637941c0775777b1c766c1f120ca7a53ed55d098ab80cab635

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 03:19

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ea7cb9bff92b5586d7e15b3bd0ec7d2e_JaffaCakes118.html
Size

175KB
MD5

ea7cb9bff92b5586d7e15b3bd0ec7d2e
SHA1

76f347486301df3f74e8ff86c9866e5b2bec964f
SHA256

823d168f17dff3637941c0775777b1c766c1f120ca7a53ed55d098ab80cab635
SHA512

b93e3b4d6a422f170b975e32c15235eccb51b7a00fec06b05a61a2b8e01593de3cf798425834824fe3754798ca1e48b55265137bc9b74c6d72037c74719aaa9d
SSDEEP

1536:Sqtz8hd8Wu8pI8Cd8hd8dQg0H//3oS3oGNkF5YfBCJisF+aeTH+WK/Lf1/hmnVSV:SOoT3o/FcBCJiBm

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3604	msedge.exe
3604	msedge.exe
3980	msedge.exe
3980	msedge.exe
2512	identity_helper.exe
2512	identity_helper.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 3684	3980	msedge.exe	82
PID 3980 wrote to memory of 3684	3980	msedge.exe	82
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 2904	3980	msedge.exe	83
PID 3980 wrote to memory of 3604	3980	msedge.exe	84
PID 3980 wrote to memory of 3604	3980	msedge.exe	84
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85
PID 3980 wrote to memory of 3500	3980	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ea7cb9bff92b5586d7e15b3bd0ec7d2e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0x40,0x108,0x7ff9099546f8,0x7ff909954708,0x7ff909954718
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2124 /prefetch:2
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2204 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2840 /prefetch:8
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3280 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4832 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5096 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4952 /prefetch:1
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6016 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,5122041600564934834,3115002652105652792,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4360

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1644

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:516

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d18f79790bd369cd4e40987ee28ebbe8

SHA1
01d68c57e72a6c7e512c56e9d45eb57cf439e6ba

SHA256
c286da52a17e50b6ae4126e15ecb9ff580939c51bf51ae1dda8cec3de503d48b

SHA512
82376b4550c0de80d3bf0bb4fd742a2f7b48eb1eae0796e0e822cb9b1c6044a0062163de56c8afa71364a298a39c2627325c5c69e310ca94e1f1346e429ff6ab

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9eb20214ae533fa98dfbfdc8128e6393

SHA1
c6b5b44c9f4fff2662968c050af58957d4649b61

SHA256
b2be14a1372115d7f53c2e179b50655e0d0b06b447a9d084b13629df7eec24ab

SHA512
58648305f6a38f477d98fcc1e525b82fc0d08fb1ab7f871d20bd2977650fa7dafa3a50d9f32e07d61bd462c294e7b651dc82b6a333752ca81682329a389ae8c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
432B

MD5
a4c4f97ffdf9942b40c356cd46196ff1

SHA1
89b493bb6d4e1e844e65ed73162662f32e81e76a

SHA256
cbc1d091b45716aabf320a9ca3121c909822aed8ecbc7f2e9531bd15f3b1ad88

SHA512
8755d1fe368b823ad15ebb11b3039f93ef18119ed63b33bf2531f51f603d3eaa553323d9ac43d6b3a3a47f9f517e3c1337e7aec85bdfe90ff60c9e30d2ccbb6b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a3964a4fdfe41914346d460ce08b1356

SHA1
9b26406d4c07dc0e3df09161fe3de964853165d0

SHA256
4fd31e4ed022a3ebfc591bea7a844d3bbe8859c69d95f7b586faa5bf39772c10

SHA512
ffb6cf0a0a35728f34e7cb91430de9d22815dd24127e57107551fbbc1ead3a77ebc8780795ce20d99b7a881efb1bd2d80f6b55a458f971194de5425cfbba89c8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
7db478b138182c24c954f1339cd9caf1

SHA1
82a962b62ff3680041bf90c0e67e12a1b5ecedb6

SHA256
64806ef67b3d86547535e693fa8ea1d5973346a8d48cfbc7e8c234d1919acdbd

SHA512
3118d5e8775ac8c6629d8ffd5cbb6ee98443c0591376e9295dc5c65252a23da8eee66466c0d8cacb99e347f7ba7789d0d243d650942a0eb2f1017926175aae58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
52e735e5ac94dbf22372e6e4400677f8

SHA1
d99e8708dc24b3a53b883ce544ad71c998e0ccc3

SHA256
5b833985ffa18b3feed2da11d0816d9ae5318c44763409ade0788a4baacea6be

SHA512
5376539695ef3314656a1787a6d3515c6f3f21df89f7703f2761122a88b802b655c3d609f05bfc681df6f33db3e0bbcf66392222d1c1ee405051a985a3734a51

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
2bf3fad0dd872be67425896052a77cb0

SHA1
cefe201fffaa98f4c261c542d68276348916fad3

SHA256
a8705a222bd92b4faed21f4fdec6f63fdde007b81ea95cfe82559b0c3aae7934

SHA512
59360eb435ba6aa6228d7d1224c8ddd5d969d24ea40c0e3842d1b3911a73f25b39bac9f289313dc567c8617100793928882bae598350bd5416c80d368ff11bf5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
6be217d826ff7c4aa81d39663a38dc10

SHA1
b32f46cf12fc4821f702880382f18ef3714eec66

SHA256
754dca9404f119306b757d135efbab8856521366fe9a3961c5373dda2a57becd

SHA512
306a06b11f079ad10db885200c0bbe37b56bd9687024e18fa84cfb95663f8fb00debebb381e030d5e6c4daca8eddcf180a37668745ec4972ef732dcb0bd4296d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
820f6f7e9443b2bc03564a7262c3c1da

SHA1
cf5d7be7d8acbb8e524b2b829a551da723128605

SHA256
038e1cb763520a79341c07f7f8e8308dd796b264d7ee340bcdb483571e8f1e7d

SHA512
91a1394dd73c82df4f2971e2ddb1274134b1033c555f33903ee09bf057097366fa789af7c4bf17a88744b929a2e4825013614ed1e0a6a156e831ef1c7ed37056

Download Submit