ebb887ecf35c3429b45c5adb02adb1d8f3c7ff52dc7b08e68b066abab78598e0

Analysis

max time kernel
149s
max time network
156s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19/09/2024, 11:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eb3e974a67f12bdf5f7c88fbe2fffe27_JaffaCakes118.html
Size

166KB
MD5

eb3e974a67f12bdf5f7c88fbe2fffe27
SHA1

a511f0f47a4704debc76277c6bd4a449dd665fab
SHA256

ebb887ecf35c3429b45c5adb02adb1d8f3c7ff52dc7b08e68b066abab78598e0
SHA512

b2b6badff8398f875487abd527a8dd820e2b6a6a7fe0d334353edf9bd1d4ffeb97f324fc30cd9c8c9ff2e49aec9dde810dbed943589505f65d3ec61956763845
SSDEEP

3072:NwbmcAHJzwq1rRsryFGQr71sgDomfGFjLt2jdpCIQKtWlkeNVMs8sMyKMp99tZ6:NwiIQVomfGFSpCKyhKf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4212	msedge.exe
4212	msedge.exe
3352	msedge.exe
3352	msedge.exe
64	identity_helper.exe
64	identity_helper.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe
3352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 388	3352	msedge.exe	82
PID 3352 wrote to memory of 388	3352	msedge.exe	82
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 2884	3352	msedge.exe	83
PID 3352 wrote to memory of 4212	3352	msedge.exe	84
PID 3352 wrote to memory of 4212	3352	msedge.exe	84
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85
PID 3352 wrote to memory of 1220	3352	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eb3e974a67f12bdf5f7c88fbe2fffe27_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe15eb46f8,0x7ffe15eb4708,0x7ffe15eb4718
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2624 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3256 /prefetch:1
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3272 /prefetch:1
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4672 /prefetch:1
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4640 /prefetch:1
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3376 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4860 /prefetch:1
  2⤵
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  PID:2772
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=4620 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6020 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=1980,4833438791526720043,13495533905524144074,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=3448 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1276

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1204

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2900

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
7327b7d358a91b361c0eade5ef8bbf38

SHA1
7ee2f39fed9d7e6712cea9621b4c29296ba209e7

SHA256
31fec8d7a88c96e75d35a1a1ab062427950cf4ac6483e5278914111e703bef7c

SHA512
aaea6ad7d3d2f9d2199131e14277039ceb5d5b9e66455567ba0a24f83552a7a83431d9eb55d19e77ea15ed5610961d17ec8f793283f62419c560b5d9f2e6b7aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
3eba5858aa5e92e4bb3c0196e6a2e9db

SHA1
cd57abe99fd787e6d9a2e42c6d585a68c768b0ea

SHA256
518bbd9b7d091f2e559ab574911dfca6c129cd5aa9e5fa0e37185a2013cb3907

SHA512
80f83ea790d31a914a32f8b52715a49c07e87f3bb1ef5166b7b2ac4e0a6851a9cf1db666c28c95c34fffdb4a9e9ad8a6a6a42841c23ee1e50d45601c4c5f9b02

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2fe29982c63cd19a33af5542ae91d945

SHA1
1dab4de26f33886dca407684faa25290abb943dc

SHA256
3065a04051386e375db8253cdbb7feda52235e53e16e2d28a0dc7c8369147b34

SHA512
afbb001b66c64e2deed42fd49545bb3e514e4474440fe585ccc6824caefd944084b664a6ad348e5cba962dedcfb07442b9f21ed18b58a0c3935bdd54f0b282f8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
acad276df3478a1afdd81afd70fa208c

SHA1
9517c7b146935ffd92a8581366462f1a282b67d0

SHA256
38bbdd40f087784932985b9f0ff6aa64e8caff2203bbd34a126f18595295af99

SHA512
8272aa0960676faedbb0a4289b6ca8e129a4648e4c83c8d52b3f15175fc5e37357ba9271f63a7568e923ed18b3015bf4c62e488ff51756401a5da6ce380588c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
fd7c4ce0f026a5af5ae7c8e7ef280e4d

SHA1
1808ad6f17013e5707413b4b83d30267f1c03cf4

SHA256
490ab255293bb9904162d605f310ff50bc2b60226e28a998e63504a980e22c0b

SHA512
c6111a2a49a568dc127babe5bcb59abf8c10c207bf8c1dc4953837881dcf6954ba88c3b3491be9a9ea8bc2e77da74709739ef0eaa1c741b2a9ba588d1a8e9298

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cae93848ed7f8fdcd12b4387c05e53d8

SHA1
8b5300b6b5912d9a553a06725521221d11a4bff6

SHA256
21680f13df1368d0114f4abfc0a51312a5aacabcd243b6895cce0d07e6d8cb53

SHA512
d900811de6a1bf9e2520e8411b532b3eb6081469ba384c94e0f567aa275124927c80326a622ad2a8f88182aae8da34609a1011ae2c34bf1e4598ad693f5b8bad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c916677552174b0b92163e69e38a0a1

SHA1
2f44cf915b478e56a6f076a121e46dc8da8ed48e

SHA256
9321a82b8b22a90cae8de70a370bbd764b6b0225cb759103afbcf4cc4736f360

SHA512
274fa49745d8d3979ba09cf4fa0dff3c27a05746046a348dcd82da15e9017ef287f916001da80ea3c7b9e4968e23d4d64e642c708dce503a8e8db8227cb3dc4a

Download Submit