a50ac90b11487359dedd01ea3cbb76b6694797e3e19c077ad7bc5efbc7f601c0

Analysis

max time kernel
145s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28-09-2024 14:39

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

fc82cf787598884877b0d85450cc95fa_JaffaCakes118.html
Size

23KB
MD5

fc82cf787598884877b0d85450cc95fa
SHA1

b6806591607bee24d7948d05960edaa93bade40c
SHA256

a50ac90b11487359dedd01ea3cbb76b6694797e3e19c077ad7bc5efbc7f601c0
SHA512

9cf6445dcb2bef67db467fbd9351bc8b262d3d152c1f92a0d0ddc5a667ad64233bc0b8e9683b75b981e47d19b159dbc3c97d3ab67decfd651f1a893c0f4eeaf1
SSDEEP

384:S27p7XQdQKTq5TeBVq+mbHSErWbq77ICnJiL6JxKN7M78jvl6C+HISU7A1pupy9g:S27p7gdTOVeBctsq77IoJ86JxK7M7RfS

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3616	msedge.exe
3616	msedge.exe
1200	msedge.exe
1200	msedge.exe
4684	identity_helper.exe
4684	identity_helper.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe
3544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe
1200	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1200 wrote to memory of 2872	1200	msedge.exe	82
PID 1200 wrote to memory of 2872	1200	msedge.exe	82
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3472	1200	msedge.exe	83
PID 1200 wrote to memory of 3616	1200	msedge.exe	84
PID 1200 wrote to memory of 3616	1200	msedge.exe	84
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85
PID 1200 wrote to memory of 4504	1200	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\fc82cf787598884877b0d85450cc95fa_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbd45c46f8,0x7ffbd45c4708,0x7ffbd45c4718
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2204 /prefetch:2
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2604 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3224 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3236 /prefetch:1
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4700 /prefetch:1
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6116 /prefetch:1
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6112 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6148 /prefetch:1
  2⤵
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6780 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5200 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5528 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5588 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5916 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2132,12762213112492352759,14870760331696076627,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4912 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4028

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ecf7ca53c80b5245e35839009d12f866

SHA1
a7af77cf31d410708ebd35a232a80bddfb0615bb

SHA256
882a513b71b26210ff251769b82b2c5d59a932f96d9ce606ca2fab6530a13687

SHA512
706722bd22ce27d854036b1b16e6a3cdb36284b66edc76238a79c2e11cee7d1307b121c898ad832eb1af73e4f08d991d64dc0bff529896ffb4ebe9b3dc381696

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
4dd2754d1bea40445984d65abee82b21

SHA1
4b6a5658bae9a784a370a115fbb4a12e92bd3390

SHA256
183b8e82a0deaa83d04736553671cedb738adc909f483b3c5f822a0e6be7477d

SHA512
92d44ee372ad33f892b921efa6cabc78e91025e89f05a22830763217826fa98d51d55711f85c8970ac58abf9adc6c85cc40878032cd6d2589ab226cd099f99e1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
72B

MD5
768f1e06b27f5faa42c304c3780de2c6

SHA1
770128d23c2c3f1f601c7f275cca80ad698b4dfb

SHA256
646c18660fc5f41b3b98258c74ccf6d5df7f4fd42b7bf0f1ba29abdba1136d03

SHA512
596b5b3ccbc5f9334b8c2d2df769a96e03db143ffe0b8b66f687ec22c70ab46e66f95f2f51a4672c880a9983969ed5052ecf6a4ce3ecdc7e2f805a9f4196f31f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
81f7d0569bab5f808ca30b9b4bc80d32

SHA1
7575a1aa610fc4153c76ff8cb8ce9e5ba238a5bc

SHA256
0246e3d4da1b5b4933428d04550f8a9922d27215e037a2d516d611cc6836e275

SHA512
de60afb4167de7ed4a379ecbd3bfbdb0fb4cdcf131c4f093eed4b95cc7c82738107cf96da59a2c262c308602ee59366a8bcb5ddcc13cf767bdc180038b4e784c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
9a735f12953b9cdffd8a24c0bb5adbb3

SHA1
0c7dca7694e3cbab3b9cdd665ccd88c84fdc9fad

SHA256
9ea4e517c51326516003e64027265033a6869280fb25f4ba3708fe5c26fcaee1

SHA512
fe8cde2ebbd665d36e3cfad48b585fad76ab6067c546cd72fafd3af129d372b413c926ef262518cdb609d3fdca1ca1ff69613b488af90a8a1e76dd0795f95bc1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
285252a2f6327d41eab203dc2f402c67

SHA1
acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6

SHA256
5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026

SHA512
11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
a2a008a3c747531c9321f2fa4a650d49

SHA1
74dd2b4379611b0d3c5c79f5ea676c2cac4a1d30

SHA256
a4331c901a1b2dacd654014004213947b5ab917cd33c53bf8db8f866a9055331

SHA512
3c1f0cf965a33e9565a7cd8e3ff6476c8189057d90424b0250fdd2da4d33ce3662605b86f6d1212f72043f95a45fc7310f4074fcf5733f0761379a1cc9ea48fc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ddde498f066aac4a563ac777758a03f8

SHA1
646cf25efd45ddb2b3966f1419ee41798e9c2372

SHA256
37256df7acebec7da878f95adc0b44fc7e5bd2cb609ec0caf451e760a3e2cb72

SHA512
6ecb8a56feabc5c59bbf7bb721cbc405abc9e353cc92f2c6dc44c4d9d831f67bfb4b3b1c7f962753912f386a736da16972f2cb39a0d2d6bd469135035fc49994

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
8207fb1eb65a6a311aec527c5ff4114c

SHA1
6bdceaf7418ff7aec554fc3f43237246c3d0de83

SHA256
2c4060c111d3c0f82bdfe618db901f53150c2c8979929c4c60b48ef7e337a8b7

SHA512
b21caa2aec3e888da8b8ed2385e175a91749e6883701accbc7c06be965b8f34b46cc051c635736c9262f783195a256f19a409c970265981616500daa09d9b9d1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
478aeeabf74d48cd29b985b9da077122

SHA1
224df98f4c23accdd3d42d85c3ff32a74dfd4f33

SHA256
65a0a5bdf2845bb076b398eeb0f6759f498e4b2753f99fd4d089d78d9c63b9c2

SHA512
219673e53ae5bc2a7c949fffb56144913d0f67821719dbd2bd39a47b722d22eaf62c6ecc45f2397a67ceecf245d8cd8f0fa44f5051e07e04c3168cf2296603db

Download Submit