83fb31bec4737c4931751160b83d31fa6747b9fe4b4937f65c5bf26e03424b97

Analysis

max time kernel
145s
max time network
139s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
29/09/2024, 20:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

ff535ec490259bbc3c4ffd61b96cbed0_JaffaCakes118.html
Size

112KB
MD5

ff535ec490259bbc3c4ffd61b96cbed0
SHA1

5ba6d42df5170aa8797b940749b5c3142c238d6d
SHA256

83fb31bec4737c4931751160b83d31fa6747b9fe4b4937f65c5bf26e03424b97
SHA512

3d60435478531dcb067bf6a7af4790b356a8523d14917ac4ca734d86efea1d2de11005409afa77db5d3931ed94aa2f35fa4015b6d6740f54ba504e1345244c4c
SSDEEP

1536:ape7nZxOOOGG9OcQWOzOdiOhO3O9wMJ1BbDjtczO/:6+QlXsl6d5g+9wMJ1BbDjazO/

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
368	msedge.exe
368	msedge.exe
3620	msedge.exe
3620	msedge.exe
2328	identity_helper.exe
2328	identity_helper.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe
3620	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 4460	3620	msedge.exe	83
PID 3620 wrote to memory of 4460	3620	msedge.exe	83
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 3172	3620	msedge.exe	84
PID 3620 wrote to memory of 368	3620	msedge.exe	85
PID 3620 wrote to memory of 368	3620	msedge.exe	85
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86
PID 3620 wrote to memory of 3212	3620	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\ff535ec490259bbc3c4ffd61b96cbed0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9feca46f8,0x7ff9feca4708,0x7ff9feca4718
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2144 /prefetch:2
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4800 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4912 /prefetch:1
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7104 /prefetch:1
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6308 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2128,11594554563370583878,9696752933359932745,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5960 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2552

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:536

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
53bc70ecb115bdbabe67620c416fe9b3

SHA1
af66ec51a13a59639eaf54d62ff3b4f092bb2fc1

SHA256
b36cad5c1f7bc7d07c7eaa2f3cad2959ddb5447d4d3adcb46eb6a99808e22771

SHA512
cad44933b94e17908c0eb8ac5feeb53d03a7720d97e7ccc8724a1ed3021a5bece09e1f9f3cec56ce0739176ebbbeb20729e650f8bca04e5060c986b75d8e4921

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e765f3d75e6b0e4a7119c8b14d47d8da

SHA1
cc9f7c7826c2e1a129e7d98884926076c3714fc0

SHA256
986443556d3878258b710d9d9efbf4f25f0d764c3f83dc54217f2b12a6eccd89

SHA512
a1872a849f27da78ebe9adb9beb260cb49ed5f4ca2d403f23379112bdfcd2482446a6708188100496e45db1517cdb43aba8bb93a75e605713c3f97cd716b1079

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000013

Filesize
23KB

MD5
c897f8479da25ec570027594f1b4db24

SHA1
81a3ff06cf35a87e697fc4733966dffc270ad06b

SHA256
7fd05e325904c9c31e435d5c65b9b4ffa11a9116d1df0282d6cd7c87ef6f1dbc

SHA512
b1c1c46810c3bc5c407f7d30a9d74db8242860965d958ffc5bfeed35b1204774843775ae81b8c414ea89322d00d7ab97313965e20cebba588edf13b9b8dcbc10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000015

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
ab56ed2ebace8fb98e25c0e3d6d499a7

SHA1
c64f2c02af5ce7c28951f7e7c50ff2e90b384217

SHA256
98811121f7969ccf1496cd40786d7cba7d36575c8a474c136d63b3cb283dab95

SHA512
94cc01e8beba9a050cc3967cea2abc55dfd39f448302ba9fb3da853ea3288e42f18d920f81c9c5f2a267a50c1556133f363bfb07508074d6f7389cf8d6b52022

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
408B

MD5
c267e1102cd83255fc3ea3de7fa441ff

SHA1
e5678062084815b4c4a38696644c1c6b3cb75e9b

SHA256
eece17b9efc3bbbd250e2ec2357739462d7eb43674fed3e36f1b8765d9293425

SHA512
b0ca22dd28a3a318e44220aa8bd38f8ba295b75ae900af502b4454d3319401cb73e6fc54c10fa8cd513c766cffed291b6944859e5c9eefae1062652ea306bdb0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
6134d2a025431e7b369bb304f7e96d32

SHA1
52c9cf7f38e0d47ee2694dff9adf4bcd462d0573

SHA256
098c98ca5236f673c41440843a74c1a40ce89d50019fca277605804739ac0d33

SHA512
4323aa42b7c8815f8abaaeae1a89d0b11e2c759cc9cc86051062c954cfc947c29108f7118d9925b23f4c6d1483663c8c5c420c3a7af05d2e628a91952e21d7f2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a29f56a19be0071e45a3d73483f82b15

SHA1
913af9a0e39938ced6a59dd954cbfa20bd57805c

SHA256
5822c1301343e39677b344a182369288cfd828243a5dadc1343d6c8de188f0a9

SHA512
1b4c8a6084d01c04a20b04d08abc882abfefffc4d1502bc7c3157a19fcb13e1bd39cf865ea2dc62500eb1471b5daf8729b468929b9e1d78a4be7f666ec7cd5fb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
e41ece56021335fb23748dd6726d6032

SHA1
dc751de3bb7f6c43c5a16494bcd46a61e639bfb3

SHA256
05fa9bfa9395ceb3645d076581d36bff6a25b50d04122ec7e9023034304ad203

SHA512
c951fe4132076e7a1068d97bc049aaf96ffad0b7be8604e86b81ae23f40fbc72fff47f867be3a7877a21f24ae15c5a254fe788cb9f3f9604ce2dcda4b6c76796

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
466e1c393b2f8fc2f9e7a4e5fa4d2d79

SHA1
b97a6c4449f1673d6baaf64675261983fd426bc2

SHA256
28848a896b9779f375a95d1e9415cbb9e0700683a7da84d93b81c3a646ae5a58

SHA512
c0a1916756317b566e4111b5394a653a5fa3e4d01a689dbed61313afdbcb69844b3edea0cf3153e3108ff7c3c7c46c6be0b7bb0fa3a16e505c2b1dffd59b8d1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
d9a55ac5d81ab11ea6a97b8fd10c1ddd

SHA1
7d7c16c30c3bee96cce21fdac9e42ee39e9e9679

SHA256
33653475b54d4b2cfcaa191c9d8484610f6f59e13e0b74dee908aab867a55d6a

SHA512
73e4e0c6d8a3994b100ea22ac51ee69d09bf3e02710969a54afae81a32654cfbd3d76e2fab6760e0d6621b9a12bbec45a9a1febe2e2a1e689565892fbcc80b87

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d27c6c6f02dd56637a51446bc83e904a

SHA1
41491bf7b995a021e14a0f1871ef14cc0ef995e8

SHA256
c3d6a2905aae1111ce1e08c2027f76f31a9e1f5b5bae65541a1cf482a621a55c

SHA512
a0f6f3c3bddbe7ff4b67d8b3169cad968459b5145a7c110cebf63e30674ea36fcfb0c04e2edb315ea7ce89340493b78dbd92dc17e5f14538db043e08693927d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
1180023f51b64034b1c0c7fffaf645cb

SHA1
e987048986ca92e183ca4d43af28db6f0ae6d86d

SHA256
bf08cabfbfd24cf746dcd82f6cf6297e576f3060d572e8167bbf0f407f9942e9

SHA512
0a1a5a01f820a4acbdd5dab1c06358b38be88bfce694e2d997e8a31911c80030c6e4170945d31806ee4acce2a84b7527e77ff1609bf91794c8e40460187fbbba

Download Submit