29dbfd76b809cefa225986ef6806ae0d061212eedf426cbb80758aa623a317a6

Analysis

max time kernel
145s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/10/2024, 13:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

300312a03da527b3a2c95dd977b787ac_JaffaCakes118.html
Size

58KB
MD5

300312a03da527b3a2c95dd977b787ac
SHA1

96ab82e8ecbeba6f3e3fb76844e32d3e3044db96
SHA256

29dbfd76b809cefa225986ef6806ae0d061212eedf426cbb80758aa623a317a6
SHA512

6d66e51c0272c5d9df9833b0f92d449eed7e026c72f0d159431be458f33bffaf07c427c8d1f35dd631a38ac02dde47374ac26450f8f768b66641716e533c12a5
SSDEEP

1536:SNgEQk22ngtuz8mDIYss/kRODRIjv3G+a:SNgEQk22ngteDtNRH+a

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3480	msedge.exe
3480	msedge.exe
1856	msedge.exe
1856	msedge.exe
2780	identity_helper.exe
2780	identity_helper.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe
1128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe
1856	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 116	1856	msedge.exe	83
PID 1856 wrote to memory of 116	1856	msedge.exe	83
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3508	1856	msedge.exe	84
PID 1856 wrote to memory of 3480	1856	msedge.exe	85
PID 1856 wrote to memory of 3480	1856	msedge.exe	85
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86
PID 1856 wrote to memory of 3496	1856	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\300312a03da527b3a2c95dd977b787ac_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffd47b446f8,0x7ffd47b44708,0x7ffd47b44718
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2212 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2772 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3260 /prefetch:1
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3296 /prefetch:1
  2⤵
  PID:2756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4924 /prefetch:1
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5772 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5768 /prefetch:1
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4748 /prefetch:1
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:4784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3952 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,11157831762814190449,10287855822219650861,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1816 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1128

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1484

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:888

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000004

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
829902de0a1e4d368dfaeffb869d8d6d

SHA1
91271f75ea149f40c0a28e046cbf5bb194360ab1

SHA256
4c0b0978109e34c3e1a4db5493172d486eda410b7419d5b79101d04165dcaec8

SHA512
17f5523219e2c77f744cd3103d875d5a3dfba3e6c44a5147d2ae192e9eb246f94e5c5114dcc9b737ee34d8c01e2077727ffe860cb1773d454497fafcb2bab63e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
2dd0d5d49b8582d62070276298a48906

SHA1
597a2aac4c39bbfbaee4fe8724104a305752c4f1

SHA256
0167ae440fb8adae5f8f5d3109ec5b2fe0c46fcb99607df98ccee31f305089fc

SHA512
df29ab2ecf5c48ec94c2ddab1504a40b16e14c1d00458beab7e8bad35a5d3069fa38a0dc4c4442b3c948e745e1b53facefaf6fbb35268725eec702402dbd1739

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b7bae93326af2c11434b7ee73d93e02f

SHA1
948dd9425716ffbb200c0c6d9803e7bbc35386e2

SHA256
10a2a29ac1e4b60d83c1f6de330b1503adf17d38364a8d629078bb4246c413d9

SHA512
b5539c45ecb684089c59859e16278ec749ce6bc887aa85eb03e2b92ca5b3df0a8174957234f639abbca9402beadfe55a16839c97dcde63fc9ac22f5d587e5b40

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
111B

MD5
807419ca9a4734feaf8d8563a003b048

SHA1
a723c7d60a65886ffa068711f1e900ccc85922a6

SHA256
aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631

SHA512
f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
abac285f51bcd25e5b6e2f2b693be4e2

SHA1
e71785e41a1bebfb81bcb4dddb2893bd778dfe12

SHA256
d30eb2f6e00fed2195494951d14a0a79912dccf76fccbe87835e677a5561fc78

SHA512
cb328dd9c9ac6f4074d002b43b759ed8166f447a97d7efe546fa3425ba324b55b77e7e323a5249120b86c83728eed9cff78cd9d591e5e6f6fa3a51c64d0131de

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2295645b90c185e54c80068dbfb7510f

SHA1
2b287b61cfa6d7a0119131e9ae58670e1be981e4

SHA256
9c9ec08821d99f23b158451509685e9da1ad44e22c23534a01ceb006943b895d

SHA512
250edfa4338000f01be53ac30ffb0f60dafba0225a09b15de2985c7f913b3ab061ddd2155271b6a0ac943dd9a7df03324a70a0372c5b8dc419984d744d291d77

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
841c8a4bde25dda1d2c241e43d0463bf

SHA1
9f2ea56482b9f66d33c662a040aadc0a89f0df00

SHA256
bd0c0469f96b627ded9d0ccecdbced8323cd8c33c02012af9ab3e4688bc7fcbb

SHA512
4c0e8707abbe00919988f14bc4075e45ad1d564b13995878caefef2b4d5d5ce83b4b2813e2b8fe6cc0ab7b8c3e280af29e14ef0a039c6b6c5e06cbc24bfee9ee

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
d3b1b4efbc755068633cd8fced164980

SHA1
b4f2db94a2a31964088525d4030c607cb0347dae

SHA256
cd2db08c02fd7f86b39b18b34273a4cb618c9f1510712c026bc9ab2b4f697668

SHA512
221d9afbc6daccd14ba5b05095b5fb23f2418772f651f7731b4102f093edf301c57ece1f4034f5da40029c71a121ef724eb1415efbf9921098c8f9b3d3add378

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
e3fd2a8ab183cd493ba6c92452636ebb

SHA1
359be3b225e0e51cd399c9292841a9c0745af9bd

SHA256
37bce014121d59acaa74a206cd5013367cbd9a27cdaa90a35a375b6d222c4ec1

SHA512
be1df766ec972bde3d86b8e42d5f5700c2bc7b82c7f01ba5218d518883735fd9c914e2df408ad1a24549cea7cf6e4d7b6ad0e34b144f911e51da7ab81c768daf

Download Submit