7baebbe37ba7acb75929ea01e11eb7861f12e76ae92c5753625fba78fbb714fd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 02:10

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eee0600ec55ac25dbc1b2f945f07c0e3_JaffaCakes118.html
Size

93KB
MD5

eee0600ec55ac25dbc1b2f945f07c0e3
SHA1

dd319cb3c46259e734f0058e1b960e1cafca802d
SHA256

7baebbe37ba7acb75929ea01e11eb7861f12e76ae92c5753625fba78fbb714fd
SHA512

57e6fa1bd9bfefdc8e483c4037f3b2ba1f63349a14dedd99f6c869f0cadd24370720072b678672a327d3428d6d6e47db46cfb6df5ad29df01e128f95ce519d78
SSDEEP

1536:hwgr8VSeO3x9S6vjGI3bF5lpxodDhCaS6cgRrztmuu:BeO3x9S0xodDhXVtmH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe
3660	msedge.exe
3660	msedge.exe
2172	identity_helper.exe
2172	identity_helper.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe
4556	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe
3660	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3660 wrote to memory of 2508	3660	msedge.exe	82
PID 3660 wrote to memory of 2508	3660	msedge.exe	82
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 1420	3660	msedge.exe	83
PID 3660 wrote to memory of 4776	3660	msedge.exe	84
PID 3660 wrote to memory of 4776	3660	msedge.exe	84
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85
PID 3660 wrote to memory of 1928	3660	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eee0600ec55ac25dbc1b2f945f07c0e3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fff6c0f46f8,0x7fff6c0f4708,0x7fff6c0f4718
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2236 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2796 /prefetch:8
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:4936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5716 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5516 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5468 /prefetch:1
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2172,7619422175535163049,7341306518510218258,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5200 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4444

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2980

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
eeaa8087eba2f63f31e599f6a7b46ef4

SHA1
f639519deee0766a39cfe258d2ac48e3a9d5ac03

SHA256
50fe80c9435f601c30517d10f6a8a0ca6ff8ca2add7584df377371b5a5dbe2d9

SHA512
eaabfad92c84f422267615c55a863af12823c5e791bdcb30cabe17f72025e07df7383cf6cf0f08e28aa18a31c2aac5985cf5281a403e22fbcc1fb5e61c49fc3c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
b9569e123772ae290f9bac07e0d31748

SHA1
5806ed9b301d4178a959b26d7b7ccf2c0abc6741

SHA256
20ab88e23fb88186b82047cd0d6dc3cfa23422e4fd2b8f3c8437546a2a842c2b

SHA512
cfad8ce716ac815b37e8cc0e30141bfb3ca7f0d4ef101289bddcf6ed3c579bc34d369f2ec2f2dab98707843015633988eb97f1e911728031dd897750b8587795

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000003

Filesize
23KB

MD5
8dacefa7bb352d2b95569393f3a5eb5f

SHA1
7ef7578dc6124de19dd7de01ba7b3be794496aee

SHA256
7862aaba2bb596deb55e5d756d15f3d5594934dc43fca323d3af5a623c277463

SHA512
955f24bc7dfd5ed62bbcc6a3d6406fb2611c16b1a0ff7525a130f53b19bca1cdbc7f14b1112b5be76268ecc90ea1707c82caa6a8eddaba09fc0dfa1bee82f75d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
56KB

MD5
9aea170ad0cd436d974afc1513f3b5c4

SHA1
f8232c587e63ed752260d2941a78a269c01c16a7

SHA256
13383bde9c3cca3b1b575c4fa92917d33fb77189c311169fd370aa8349536dff

SHA512
f426814d6a8986ec512d25de2de26d0c3c77c2c2f9e4773bba8830c75764460adc8924ce4bfd882b875fe64ab97a0d1c9bcf743cc7efc77bc9c3acf0a4bbf125

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
971750e4e512f3012454ee707a08e889

SHA1
47801a909451b42446e84d770999f2259c267737

SHA256
1bd2054b16c77f2a850c61c2298c3d05cd54ba5236ea15c2a59a0e102e2d40de

SHA512
f50d57ea5176ae775baf3628d2799f1e3845db06f2555cc30cc41f01f9c0f49e15694615ce0e99d4c5fcc8200929e59c524727f94a23f16095f141ed60251fac

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
0f249f23712bb8ceb172005b604f87fb

SHA1
239acb5522d2698584cf72c99c7e787d2cb49ccd

SHA256
9e13885f16f55c9881a5f2ee63381d5132b74451f13c0dc6bb82ed4439b20ae0

SHA512
e62d920ec90580f0cf8adfc1d910cf03364aa9d18d89dcfe5cd8a7387fe10fa44e926ee3ab0f93f6534307d105d7ae2c15ece60adc3c29b97d32ac18302052c6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
821B

MD5
5becd701fb741de84b1647bf251e08ec

SHA1
e144c2cc218c7425d9537a45aa8ab464cc245682

SHA256
dc3f789bfab02b5b60d0964d2915f5b6b2ee245e0cb802b368a5156aa0fd5f9d

SHA512
02c11e3bde1c769d19c4da1fa2c80d2df61d392ce5f3beffc46f7b86e96500d18f3b86c794337b285cccabf5b31083472c6dcb4dde4c6c06d85e0afb2aea65c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
587b86e1b8a8f69a1f27ae72482ea643

SHA1
cb0bc1225fb2f80130aa76eea5ed4289aed2faa3

SHA256
09160ca6985891e1a71f40261ed83c9491a8c41d57acd8817583af2f438a38c8

SHA512
08b08476bcf8af55606fd488ffdb24dcae8c7c6cfb1e7ee392647cd5bfb89dafbfbb60bec208c03867e1b64e5951ee372936f7377bbb335e83248064605a0d52

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
909214cf6515bae4c7646c23f99b6716

SHA1
63de0434325b35b71573d2930ade808f527bfc84

SHA256
c30cb823820a393dcd794b3f00e12489f4ec543b69658b3fe30d40b8ec7c4c11

SHA512
f4498af39c08aad21134079654ef93c2d5d52b7abe8f20bbbfb31ee853201b0bf6f1602f3d3c8ff27a85c149b47a26460113962640e869a43429e84e236f028c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4268409c9960798a2b9fb7e1b7925624

SHA1
807446a33c96030c91e26f0827de3ff411345269

SHA256
f3f123706f5f2248d5cb93d94c0845a5648d962e39a1df21357aa146f9dc9617

SHA512
b4834c5896ab9f617ecb6a40f10319757021c4451d22b6f9bb231748816de96eb659acd7e5020156b078164169bfbcb49d18dfc1e1e32f99478041c528b52364

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
b14200a813f719de50dc18b4ef27c5dd

SHA1
298f0f9fdc5166efc27fe4378b5d778fcedfe1a2

SHA256
70d0ef5f07faa93788ae569995310f094f1f1717117b565beaedba0b698ccc41

SHA512
e54b3adac1809146372954d0d690d9bbc544af7d13c3a9cdbe9ecc7c8231e8981f5c82cfea5dfb882c83517d9514fc52adc1318df39018f734be1e1eed296123

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
27cfc5832b55baa13302af5c1df89176

SHA1
79f0105820da72d812a39df7d28fc90f6ad4d052

SHA256
4ba8434ced2c3432e2806095a72ea78f4f2310635737ed9ae1c3d61f17e51579

SHA512
76d48296af657412be36f34a4276ed1068129aa20b958505bd2a957c24fb28e7d3318216b267eb96e24fc0837dd5205ea01223406683a320b160945c3b2bf7c5

Download Submit