f2d86cbefb5063dd549984cae7d1ddc3dbb68e49125eddd874877741eb452fba

Analysis

max time kernel
145s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 06:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eab8226296c1aaa4880b94e4b0819d56_JaffaCakes118.html
Size

150KB
MD5

eab8226296c1aaa4880b94e4b0819d56
SHA1

a723c9242280d7fad33617696eef43e9cf67745d
SHA256

f2d86cbefb5063dd549984cae7d1ddc3dbb68e49125eddd874877741eb452fba
SHA512

c94d0ca0e0fc054dfeb56cbb6d4a6222d713a1e8477e0356292b09f7f85f2e6304d778da1b5a7b87458a6d5b99237e0c92e2de82c99ede1081d56615d696652f
SSDEEP

3072:MFqccJ3g7t1ptVC2D1Qyhc/5bQX3noD67/1OjGFB:MYccQC2D1Qyhc/SXCW/1h

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
5036	msedge.exe
5036	msedge.exe
4788	identity_helper.exe
4788	identity_helper.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe
4560	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe
5036	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 1452	5036	msedge.exe	81
PID 5036 wrote to memory of 1452	5036	msedge.exe	81
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 4512	5036	msedge.exe	82
PID 5036 wrote to memory of 1828	5036	msedge.exe	83
PID 5036 wrote to memory of 1828	5036	msedge.exe	83
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84
PID 5036 wrote to memory of 5032	5036	msedge.exe	84

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eab8226296c1aaa4880b94e4b0819d56_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffc136f46f8,0x7ffc136f4708,0x7ffc136f4718
  2⤵
  PID:1452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2168 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2220 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:1172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4688 /prefetch:1
  2⤵
  PID:976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3856 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2156,2448943298763472417,361772888554834660,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4732 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2784

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
109KB

MD5
8354249a52de108a0e1e4dba57bdb865

SHA1
f6de6520cbdf363f4ad00501e56e7b162164a0b4

SHA256
7af4110ab66064313829166bda677b435e70ed65e5a2f870656362ec13094eb5

SHA512
3cb5ba4469478cb0fdfed17c9ce1549cacbf623690a48d328376d7e3bdaac8cb31a89b9035c97fcf873ec03e9bb544d9d3eb6010654643237e71e2fa6bbc5d1d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
480B

MD5
ef427f9698cf29e3e0865dcf8c4e5c67

SHA1
bbf6bcfd38084767f5f5f235319b33f80ef46cf4

SHA256
1a8371f3ed5453210424e3c6228ac5038d99506997727e8fceb52707f8a7f31f

SHA512
ea70b66122560f4d6cfd409962c65ab19adc836c12178d25b3acd00de39f625a84e03ede46b380e60c30084484c564835467fd03a42760f32b2167eda6b73753

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
fbeedd5d3e104ca1dae34d90c6cdebba

SHA1
040e78b53fe80c4c185a2e1217c42ace5be29144

SHA256
71542ee69b5737a70d9cb3d1904d70fd54eba2a88d05cf676700dd110141f0e9

SHA512
3fb5c227eb554a2948ee210dba15a41804be31c154fa0250c6480ed3de9736ea55370e32bc292813fbc0b699af14349b7e57f701fa1023c3a90090bbe1c03968

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
308d9aa67482bf47271d04982de487bf

SHA1
9e052dc6d5aad754647adfb1b2c0a9bea5e2da50

SHA256
2f018b68bc3cee85caaf409b12b6e86d3f8319df8e28cd8b15cbc8ad26e60189

SHA512
737b661be8b31ddef7fb126180e1cfa2a0b9510c476868922b90cfcc57592ef7b5a9f3c4f9785c174fc4fd3486b2abe25c02d2bce4040272fd262618715d7322

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
cac013c69f1742d291d27ae704804438

SHA1
87bf69d307be84fd051cb00d2ed291b933b23f2c

SHA256
e2c5d0cbea5399c34afcd2f20fd38a99bba0134a5abdbbf7cec7daf352e3607d

SHA512
31e32123baa60150bbcb288c308e4977efcc917fa1ab9637271b1a976c34910efefaeacb7711d24ba876be9cfe9b032bacf10b7cbe647771ed2ab8c7ebd99e30

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c2a152f64e2d0be9dfbd21ab73d43e98

SHA1
fa2a07c6178f75774522a12149e5d04a9a03ec12

SHA256
5cf4921e34141c7cf00804509cc0765471edcfcc66fa4ba7bb67b99d7702896c

SHA512
9cbabd928ac7f1460071abd6a4bc21b769e1d7df96d987f4b933dbf6e6be87f8357838f98d5c8a48b61fb524de1f6f13be43f9fc89d06f3ca09fe7f9849379db

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
06acffa4e471cc3d7dc658d3f5060533

SHA1
f7956965c9141bd816e0dedc7a1b4f901ddde5ac

SHA256
22643de0974575ee70ea45914cd7d6018d275967ff4889840a9eb5caaca65156

SHA512
99f99a83425b63678e1c39de02db5feb06d7040afd52e4ad34fc3f4c37cc167d2a0e966580fc667111d4cca8d5a6fbab62dcd6d3294ab94e6b3c1b4787fb75d9

Download Submit