7088b2d90cf7ba8d30a56851c3684da727c48170bf8287f2add3557386d52b9d

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
21/09/2024, 03:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eefe06224ca92ed8bc4368feab53dc15_JaffaCakes118.html
Size

1005KB
MD5

eefe06224ca92ed8bc4368feab53dc15
SHA1

47dea4461b35f4d88f6b4c03b81c2633c6362bd7
SHA256

7088b2d90cf7ba8d30a56851c3684da727c48170bf8287f2add3557386d52b9d
SHA512

4b248c61f62794abd16ef517b84911e5cdf83115d98b35de7395f9f385b353ead477fbafc7d6cb05cc115c9f9c3037ebe4d0e0f561ef35d0e80bc2e071065d53
SSDEEP

6144:MkclqIMN61XBMSco+K6fKTTN8/H2E0CCjEHPkevrZ+KWMD0tEwAxZKgKa:MkclV66HMSco+KxTyimsqxl

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1412	msedge.exe
1412	msedge.exe
3288	msedge.exe
3288	msedge.exe
1792	identity_helper.exe
1792	identity_helper.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe
2220	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe
3288	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3288 wrote to memory of 1048	3288	msedge.exe	82
PID 3288 wrote to memory of 1048	3288	msedge.exe	82
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 4844	3288	msedge.exe	83
PID 3288 wrote to memory of 1412	3288	msedge.exe	84
PID 3288 wrote to memory of 1412	3288	msedge.exe	84
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85
PID 3288 wrote to memory of 1760	3288	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\eefe06224ca92ed8bc4368feab53dc15_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffd50e46f8,0x7fffd50e4708,0x7fffd50e4718
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2032 /prefetch:2
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2128 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5508 /prefetch:1
  2⤵
  PID:2080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2584 /prefetch:1
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6300 /prefetch:1
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6060 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2020,978372088174243722,13111234759478248791,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4792 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2220

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1060

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:5028

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000b

Filesize
212KB

MD5
08ec57068db9971e917b9046f90d0e49

SHA1
28b80d73a861f88735d89e301fa98f2ae502e94b

SHA256
7a68efe41e5d8408eed6e9d91a7b7b965a3062e4e28eeffeefb8cdba6391f4d1

SHA512
b154142173145122bc49ddd7f9530149100f6f3c5fd2f2e7503b13f7b160147b8b876344f6faae5e8616208c51311633df4c578802ac5d34c005bb154e9057cf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
216B

MD5
657324d10587d1680fb2c77d19e127ba

SHA1
c0db113a01a05ff04d25bcfb2d5277d15a3a831d

SHA256
360ed5a342a3857acc0f19475a6f8682186226aa058fab07b250afbbf4bbe425

SHA512
d1d76141085d75b203ce19f344ac0286240909e21e5c864d74e1210e5086a381f7ce7e9f987ed29cddcb3952e762ca8802736da294885c1f18ae92129e1e2d7b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
2dde56972b26fac302b5fa248cf62ebb

SHA1
9a4bad0ab875584ef3afedaf9da7b8fc90af31e1

SHA256
b63795f1504b64d766997ef55fa667c9899fff1e652403eee97756b8f97dc2e8

SHA512
29137ce31a964bc3a24c6a19ef0b153daa088ae01f9e1873c50130979b38c9e390481fa7e1b449a2117bbb384998587359bc1beecab7fef1fa42b13a3b76d2a7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
2e49bf7155a2048e7c1dc46d823687c6

SHA1
b40a376f61a377e78964d529d9bb44d5e324283f

SHA256
6e911aeb5c9626a2e674b3eb250eea4b76ba836c7deb46b352be362b8591a6a9

SHA512
4b0aeb6c4c63166353b76e39d0c3dfc0690962887e4daf8f275841b0b5d04eacf89cb8462bca220bee0e7b8f1316e2cc9195546e11573f9d08161cad17a603bf

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7a5b8f10a3ee563e2d7b063b2b678fd5

SHA1
1aa2a65d801b840268c4629cb23baede3b0f4db8

SHA256
6f8a1b723a32cdcbbc75ef27e8a001b40330a2e708dd1d5e50d819c2d72a175a

SHA512
2e23fa5c493d4e215a6090eb91ada6bad8cd97c7399cb6b3f2c016a4c628a4726ffe23a424f9c95c2b41a76b0af83b4df87565d030b94b65128818848cc32431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50091329e2b268f2dbe0fac40010b948

SHA1
7d0d3e8ac008f4f90dfde61fa3401c76bcd7b2ed

SHA256
b0acb6ee0c64a6fd825d5d90751a1da8f62814b7abd1a8c2436e09e5dbadfcab

SHA512
6af515b4a97094b82506a5971d91d57e272c3f02b374267333f78e35bf5026501e674cafb7f4acbe407a6f3b1ff59c7ed1c807085fb4b0f05e66a3b5ed49a8b8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9480a104ee2a9eb647e35da686328907

SHA1
57e060af573288d1616f70158ef6bf5ac6377b85

SHA256
d531410002b06bb32bf4ee7c7d3910b11842223d773a419d760c4706b72a5374

SHA512
845a0cda5606b3fd83e87bafa472a328cb9db03ddd31ef37372cfb1f55de388777b18c96f754abc66746af99a9aee4bbbe1c2d15f0ae7fa07a17e718158fae7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
700c590bd056c734fcb3579bf7c7af13

SHA1
a8f79044ea1f76a4d2b7a96766ee3d5c9e8fa517

SHA256
434264bd3bb0ab43ae973d8b7f50692a7ebf31ff74626f5ca9d218b661ea2294

SHA512
bfc7e7378362fd63846c83daf6e34fb9f89488079e3546ecb304975975a07c75f3048ef89c93948e2d600942b8ae8b088e2922da70d608727a81fa0e8e5ec9a6

Download Submit