b2d87412cfb6b01c3fa6975f3af2f34b1b394e6c421d41f1fe49d93784ee37db

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
07-10-2024 09:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

1cb08877829dea6bb6643d0381a67290_JaffaCakes118.html
Size

130KB
MD5

1cb08877829dea6bb6643d0381a67290
SHA1

8af1b6090e3ce41fa91bc57530c484effb6cac18
SHA256

b2d87412cfb6b01c3fa6975f3af2f34b1b394e6c421d41f1fe49d93784ee37db
SHA512

364053ad7bb0284f5462e9eed8134db991632acdc76af8afdae2d94a7e875ad9b9d8ae6957ba816fadaeadbf5a97b786b4b70ce8cab0dd039dd6127fd83fe025
SSDEEP

1536:sCmYxk89NMmu8u680Okh8Sb8rB8uQ8rB8rmeF4wF/SFbEwdQYimwDUUaj5IrElB:sCZR9NMwtaj5eElB

Score

6^/10

discovery

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs

Web Service

T1102

flow	ioc
33	sites.google.com
56	sites.google.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1776	msedge.exe
1776	msedge.exe
2804	msedge.exe
2804	msedge.exe
2032	identity_helper.exe
2032	identity_helper.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe
3740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe
2804	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2804 wrote to memory of 1572	2804	msedge.exe	82
PID 2804 wrote to memory of 1572	2804	msedge.exe	82
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 3760	2804	msedge.exe	83
PID 2804 wrote to memory of 1776	2804	msedge.exe	84
PID 2804 wrote to memory of 1776	2804	msedge.exe	84
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85
PID 2804 wrote to memory of 3636	2804	msedge.exe	85

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\1cb08877829dea6bb6643d0381a67290_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffab75f46f8,0x7ffab75f4708,0x7ffab75f4718
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2164 /prefetch:2
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4736 /prefetch:1
  2⤵
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4060 /prefetch:1
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5316 /prefetch:1
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7136 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=7148 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6728 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2184,14416747267149665720,12222487142070211123,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1944 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3740

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:464

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2996

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d7114a6cd851f9bf56cf771c37d664a2

SHA1
769c5d04fd83e583f15ab1ef659de8f883ecab8a

SHA256
d2c75c7d68c474d4b8847b4ba6cfd09fe90717f46dd398c86483d825a66e977e

SHA512
33bdae2305ae98e7c0de576de5a6600bd70a425e7b891d745cba9de992036df1b3d1df9572edb0f89f320e50962d06532dae9491985b6b57fd37d5f46f7a2ff8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
719923124ee00fb57378e0ebcbe894f7

SHA1
cc356a7d27b8b27dc33f21bd4990f286ee13a9f9

SHA256
aa22ab845fa08c786bd3366ec39f733d5be80e9ac933ed115ff048ff30090808

SHA512
a207b6646500d0d504cf70ee10f57948e58dab7f214ad2e7c4af0e7ca23ce1d37c8c745873137e6c55bdcf0f527031a66d9cc54805a0eac3678be6dd497a5bbc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
940f8411490f3bc3f370be62d80cf3fb

SHA1
643a948ef1c1893ecfc032f54256aa796ead6138

SHA256
55a11754b041997b805b6b73075bdba3ce67b364cf879536d62ca2862f6f3425

SHA512
81e4d5839b0ac014b46064f94028ebae50b4a88114b193043e3fcaf4f7f4a4da7c03325390537ef888af67bfe6e553a0e46cc3ba0a33f4720759094a37f2b411

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
eed7c031a4045d4fc74ffad0277819e0

SHA1
f03e99e8b3d362ff5e29fc722f81b606a8db9d93

SHA256
65fa10ff5543cf3147c0dc21e7c8e37baf2405b32cda212f857b85864d6365e8

SHA512
e9719da86b9de5a0eb674a417a4e722acb2312b1c3328676ea8f9a6d6d0f1ccf1facb53c3bf5a853d9567011e5f2d8af5793e398803b7282931f3dac7016e1cd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
8fedecb5b6030baed16c39fc4cc2d283

SHA1
722f6fc69e594bfcefaeb34663258ba6b28f66ad

SHA256
f7e905f6a60fcfd94f75304246edec002918c8e77d51b4e2d67d8fe550b6e605

SHA512
47b59d959dc4a8ef5d1ad28a76673b22d14b8774004ffc6c1fa082929105643a0230268efbab521cc97e1ca1d7e3d4a1f2a5cc7a79ffa60723ae0d95952692bb

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
253efa933a4b562b59d682404168d317

SHA1
940c8e32244b56a1dbe741c0a5e327a0dfc0b0d1

SHA256
62cb84ffaa2b3c2a3c4df94ac3eb1fd5e3ed356c33b9bbf02b0fc510a300f4a6

SHA512
91dcc1eb7c909c67b266a52e9dd8ae5f1bf4dc7373c02e9058a04c6f828fba6e9f0f5b9d901e06dbb69ee93ff528bfa6981c87bcba74591bdaa682846ac4a65e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
177cdcc7df9fb5228c676cbce4aeb4f9

SHA1
21133341ac1e803418075abeaadffa1561f2ad78

SHA256
5aef37db94af112978a2236a74ff1692238742583dceed5d5d9ad490d329e617

SHA512
cb676c373486bfb99e701168d6dd967bb626a172b1ecb0a1f363e00c83d8f31d4de235cdd8bf265cd35a3210b99863f8214fa7fdc0236a4ca8b03750ba53decc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
80032f5884251dca2e067e649643163d

SHA1
dddbff1419b417a540bcf778e3a9f19452b5b610

SHA256
afaa2ccdb3aef0e95c55f8ef4487f8458fc6983eb4c13df16ff18b64143bf168

SHA512
802647a2d7af9f22f4f18d4f3d7e64f2e3b583258503c6667b89dd90219298049860ca09c8490f2e80d88e5c106e7c2669c859f973db87ccded26fddf1c2285f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e4b659149de7b9325123b2ea0d4656a0

SHA1
1196f41686ed7026c28f3da2fc6faf6715ea84a9

SHA256
5c5b9d6833e62c6eb8e90e3b70b87ccce55eacb782354e20a3b5c39e3e1201b9

SHA512
e6c1fcf7b66ad3527f6626eec4777ad9fbdf99a58e7f71aef7ebdb830f65ad0a2eaaea09704fa1f491e4422d4e6d912e4377983180c57cb89891377cfe03d41e

Download Submit