54ba87b5a9f3bf0cd1796d8b9f531f7a86fae99834fe80cab5aa0bb9f5464581

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2dac718e9b3faa5949f807662032fa31_JaffaCakes118.html
Size

134KB
MD5

2dac718e9b3faa5949f807662032fa31
SHA1

6cbc548281d3c962b6afb497e93cb98775d40890
SHA256

54ba87b5a9f3bf0cd1796d8b9f531f7a86fae99834fe80cab5aa0bb9f5464581
SHA512

5b20ac1cd79ef12a452092569d129b4028c2042ad55572d0fcc0dd4f630534e12748b176bce196d3fc24636b82eed5d5f533b3bad29d0a30ae244f3715c12f0d
SSDEEP

3072:o47cLvA6Unbq5752WAZWjJZSqVnnKou9faj4CtntZn:lcLvA6IZWjJZS0j

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
704	msedge.exe
704	msedge.exe
4396	msedge.exe
4396	msedge.exe
4552	identity_helper.exe
4552	identity_helper.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe
4484	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe
4396	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4396 wrote to memory of 4604	4396	msedge.exe	83
PID 4396 wrote to memory of 4604	4396	msedge.exe	83
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 2984	4396	msedge.exe	84
PID 4396 wrote to memory of 704	4396	msedge.exe	85
PID 4396 wrote to memory of 704	4396	msedge.exe	85
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86
PID 4396 wrote to memory of 2040	4396	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2dac718e9b3faa5949f807662032fa31_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9e86746f8,0x7ff9e8674708,0x7ff9e8674718
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2232 /prefetch:2
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2640 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:1180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5012 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5320 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7084 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5416 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5648 /prefetch:1
  2⤵
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2240,7824423977025349512,11230864888640457834,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1784 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4576

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3320

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0a9dc42e4013fc47438e96d24beb8eff

SHA1
806ab26d7eae031a58484188a7eb1adab06457fc

SHA256
58d66151799526b3fa372552cd99b385415d9e9a119302b99aadc34dd51dd151

SHA512
868d6b421ae2501a519595d0c34ddef25b2a98b082c5203da8349035f1f6764ddf183197f1054e7e86a752c71eccbc0649e515b63c55bc18cf5f0592397e258f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
61cef8e38cd95bf003f5fdd1dc37dae1

SHA1
11f2f79ecb349344c143eea9a0fed41891a3467f

SHA256
ae671613623b4477fbd5daf1fd2d148ae2a09ddcc3804b2b6d4ffcb60b317e3e

SHA512
6fb9b333fe0e8fde19fdd0bd01a1990a4e60a87c0a02bc8297da1206e42f8690d06b030308e58c862e9e77714a585eed7cc1627590d99a10aeb77fc0dd3d864d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000031

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
192B

MD5
8aff8ff402670b927c8d49f5e817b485

SHA1
55703f0b7e4e693ea9d3b27eb526efc95f54b554

SHA256
b6f6e724949afc3d43a1a6f3a2a68f9861338135110fbae18b2a20670d279c6c

SHA512
67dc21c9e12d417497130e77ea3a1623d4642e4d8e98cfbd8f3d2d6c503a450d74173e25f73cb172b654105d8dc0da4822ec20087d7b66fa80aa51f291984e5c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
2036a6fe759a6e34dfb37afbf7059b8d

SHA1
02a140d14bdbd3e72119680882225a6ff5ab05ac

SHA256
50f39c84aab9652827dc43ecee8bbe4632f1a3afc93aac30805bbff67af28880

SHA512
6e681b6ba061051d368b27d08ebb97d2256c8b50d8ad2ae7fb54bbbc7747a59b82813a048016d1cfcf5d68bf73ae4fa4e1f3bdcb72eae1e996f02bd88880447d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
1f02abf28b03b14310c7a02e86fb2fe7

SHA1
59821c57a25e923c4694a93dfb73fbeaba76ad4f

SHA256
0c562525a1087bf857b7db517ed4c123c5d4379da134ece2dc5e8be3a2b9e512

SHA512
5326f252c16ccb81d2c8fb8749893ae26521e805af104bcb0928d6ba5141e1b9ebd954a4da5d82135a490e62835d0210901164b6f1e1692bc744e338a97cb2ff

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c463424a015fe5dc2fda351339fa1846

SHA1
7459e681957d2e80aab47750b76c423aa9168652

SHA256
53152e5b7ae3c96bf21250fa34694a6066165581fc20ae54bfdee91162a87ebb

SHA512
cef2c769bf10b26f5d0f7f560cc10ff14d608634217ac24f6085e27abcea15504e88572c4a0b33f0520fec474b79c9848611b33835cc5ad03abb9d9f1a46d2b7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
9281634caf9bf70a6cd2e90a6de0c9f0

SHA1
92ee619b9908debd1f08fa83b0739d29e5161cef

SHA256
f35361747d16f679c7b00e70ad324222fcf88bee42976a80a9f0851dfba9c530

SHA512
cce8bb75000b23569e48b13627f9083093bc3d671a341d3cdbd7b2932a6d978660e6345ed07c243df60c48bcc03022daccf9bb7a6ba1c21c2a48cfad91963b86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c666ee940537c4249c222be4ed553e15

SHA1
1475bc93844e28fd8a008c38d0cfdbbed0140689

SHA256
660b2c7279c6a83a364f2219029cde249c1e8c15ac45b20f9d4a97683d4d46b0

SHA512
97493c212a1e2fc1bfe317da08d568c359cbea1b8819e25f252d2df247e9b5cff73a78e4d491f025e0de3197a2d5ddd920073bb1942d5e1e3c290bcd7a4ffa00

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
66aa629569efc1a84590e589e933eb13

SHA1
1896fcb4c2a26fba13fdcac80d541288ec36d55c

SHA256
28a1de2a799f1889cd0ec43c04be95ccabddb5c536c5082e994fd589d66edeec

SHA512
1c0e6834efb18ca41a9fe464581fc4ef7f6d7714853d895e4a3ad543120664b50fc0dd26b709cc6ec8b2a4ac47a50b98bbf7594643a8bec23fae5f51e079ba35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
81172d992bab92ed28867ded74339fc3

SHA1
c39c5f4296cb2e0660f472094e3c2a0d87abb92f

SHA256
0d4670f4775b07761299bfa636d90c5322d1a9f86a1fd722871bc48bc75370b0

SHA512
6bd967e8139c9e9f08a6274a6f62a178e77bb340cca10aeba0ca26a38f741adf816058b8f7b714dbf250801af05ed19f489a905fda9b78154cac2ad4951158de

Download Submit