af8cd0b5da4a40981520782aa92186939d9cfe7f49118403adecf6a269070978

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09/10/2024, 09:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2e757a7af7f4309f0f05d2eab6ca121e_JaffaCakes118.html
Size

37KB
MD5

2e757a7af7f4309f0f05d2eab6ca121e
SHA1

754218ae79ad84a1df6d5e0ccf8b7ccbf0bcbfda
SHA256

af8cd0b5da4a40981520782aa92186939d9cfe7f49118403adecf6a269070978
SHA512

9ce8ae71efbe00900e439a0cb2a512891936fe743b47dcf1a9336d4163a56e9fa7459dcd2144901cca894e11c314ee4255bf6cb9886f46881353ef3479d32c99
SSDEEP

768:5iPCIWWv9K6gtcWYsRt7jht/DVARkvTSO:5iPCIWYK6gtN3fARiTt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3592	msedge.exe
3592	msedge.exe
4940	msedge.exe
4940	msedge.exe
1976	identity_helper.exe
1976	identity_helper.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe
3752	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe
4940	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4940 wrote to memory of 2452	4940	msedge.exe	83
PID 4940 wrote to memory of 2452	4940	msedge.exe	83
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 368	4940	msedge.exe	84
PID 4940 wrote to memory of 3592	4940	msedge.exe	85
PID 4940 wrote to memory of 3592	4940	msedge.exe	85
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86
PID 4940 wrote to memory of 4864	4940	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\2e757a7af7f4309f0f05d2eab6ca121e_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x100,0x104,0x108,0xfc,0xd8,0x7ffe241846f8,0x7ffe24184708,0x7ffe24184718
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2180 /prefetch:2
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2864 /prefetch:8
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3252 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3276 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5436 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3400 /prefetch:1
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6224 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3380 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5184 /prefetch:1
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4844 /prefetch:1
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2288 /prefetch:1
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2136,15372896579489342916,10032664930218906166,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4860 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3752

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2164

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
8749e21d9d0a17dac32d5aa2027f7a75

SHA1
a5d555f8b035c7938a4a864e89218c0402ab7cde

SHA256
915193bd331ee9ea7c750398a37fbb552b8c5a1d90edec6293688296bda6f304

SHA512
c645a41180ed01e854f197868283f9b40620dbbc813a1c122f6870db574ebc1c4917da4d320bdfd1cc67f23303a2c6d74e4f36dd9d3ffcfa92d3dfca3b7ca31a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
34d2c4f40f47672ecdf6f66fea242f4a

SHA1
4bcad62542aeb44cae38a907d8b5a8604115ada2

SHA256
b214e3affb02a2ea4469a8bbdfa8a179e7cc57cababd83b4bafae9cdbe23fa33

SHA512
50fba54ec95d694211a005d0e3e6cf5b5677efa16989cbf854207a1a67e3a139f32b757c6f2ce824a48f621440b93fde60ad1dc790fcec4b76edddd0d92a75d6

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
966b0cb85ebfc3e66c9e38d4872f3a00

SHA1
09fa5035b6af1e841fc7a70cd83b35f7bfe9e6f4

SHA256
5915192b262f75439c85f174c7777f899d9856d1e8861cc78aee1fcdb65197da

SHA512
0034dee4b3bf58b6533aabe1648cf1e58b07067d6fbf4e0cd4314643d556140ef67b67bd702fbfa24b3ace8be2fefa202f2f8b7e7044b40334c6b26125d6574d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
8c42464d9f7835c7bf5629246fbd099b

SHA1
99e85ac38e37aac58c3f718ecc359c0c970c17bc

SHA256
30bbae930a0e745fd6da017392a3fdea39fbdf3ab99b6cc93f28a6c721d3ba6d

SHA512
2cf99d1fb3fbd9c0833e5b0023b86ddb649d1237c37d080aeebae2ef887184fbb46bd5ed38652cfbb46132293e4a5f21164ce5e490ed3f646f297c025ab906d5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
a373821092cb9ec439c3a36ea011f97c

SHA1
b7e576636a089c94b94b85b76a5399d9ea57b8ec

SHA256
98c7ef678829980d1d8145403cd28e77f2be669987d98204ec723d65f9d0a556

SHA512
f2430b1347be3d8a36f55eb24a61fcdd576f55bdcde6e515ee08e2f83393ab65de8731f8969fb986d72331ddcfeb54c4e5d4c7f2e7c3dbbe9f9953006fa6c6d8

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
50818e34e3d732df2819d53ee4ace288

SHA1
a8af18fb7f232fea9380df1e654c997435e0d32c

SHA256
e73fb86b85b2f980827190fec75787f5aa3615693216c839986fff8d0c948b29

SHA512
2902068e48afeffd943a101627f2155c704000b613c2302a47fc77c6d588f6d1363cf0fc599b7159c2a20d922103e50b24d841fc5fd3842f34a30ed7b2f9c866

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d083e60d09f95a7aa8af47ee8ac5c678

SHA1
e3cc725df7eba0f3afdd39f576b64254d95fe180

SHA256
e64ae9790177cb430ab1d4bdafd94928979489efd490b8b8baf87bb1dc992fde

SHA512
9019b6bbca327904480f585b0437b42e44797603f0c4b9c420bf41394376de1d0ddbf6419376f40de4aefb5d43727b58917a83980eb507a2308e9eedb6008590

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0201c03067ba179d16a01f0b64e5a2e3

SHA1
de52bce0130ca17c2ce170a239ba987a2e1bd08d

SHA256
e7278fde7cfe5c9b807ff2135c9f569ed6ac4a44f877b0e275d898ad28129ae3

SHA512
36a25a44da9c3f9d967e760bbe90222d091f35f4e897779aeb27b95a3ad20a2e85e5def8ffcf0e28f766780861df757e9fb3624d4fea28080afb999d519f8431

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c523260ed4da704c484169074a09d69e

SHA1
04a9a8e8caef1c433209f3232c6eb5cdf07b66cf

SHA256
aea31c4db751951f1410d837c0329b377c1cfd50c6b97469c90d2deed2f97b41

SHA512
2223a97e64a65f74d125e05010bf2c50b8203389cf1e82fc8cdcecfc57909685a07084da518cd72f1e64b3f6ef5a6d7fe4fe68b6a94cb5e640f70b393ce3cd73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
3c2f2c0f125e05fc533173adda667759

SHA1
15010ed697ef2ca855e1f05932d5e8e4cae9d6eb

SHA256
8a5887add096e9cd2414668b5b2677cd314aa4062aa7755e58d306b4b42ef9fd

SHA512
5293ef7db7a378b5115f8ae89e20489849c1f972bf4953eeeb07087d79f4942dd5f0185f57be291fa996db7cb124e60454326d83466ce55f5ca0aceb45318a22

Download Submit