3c69041ff343a0ae8ae2cbf9e91e50e9036a7a625251af81d0885d806cd90858

Analysis

max time kernel
145s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
12/10/2024, 18:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3b64fbb3a30015e1ebfa9cda6d31e8f0_JaffaCakes118.html
Size

41KB
MD5

3b64fbb3a30015e1ebfa9cda6d31e8f0
SHA1

e911d0bc149e5ef3f6938d375faad82fdd8d0fff
SHA256

3c69041ff343a0ae8ae2cbf9e91e50e9036a7a625251af81d0885d806cd90858
SHA512

a09ab32106bb2e2a509736a7647fb6baa19f3e7f4e0b163210c2b04b1c5c5d2729c90cb685b5112d39c01c0871a6c082355d77e2bcd3579f5876a8ec97a57760
SSDEEP

768:LiPCDWWv9K6grwibyKXXDRMvdhm7jptoDVARkvTSO:LiPCDWYK6gr1zXDRMvdhIMARiTt

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
920	msedge.exe
920	msedge.exe
404	identity_helper.exe
404	identity_helper.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe
4988	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe
920	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 920 wrote to memory of 2948	920	msedge.exe	83
PID 920 wrote to memory of 2948	920	msedge.exe	83
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3900	920	msedge.exe	84
PID 920 wrote to memory of 3856	920	msedge.exe	85
PID 920 wrote to memory of 3856	920	msedge.exe	85
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86
PID 920 wrote to memory of 2904	920	msedge.exe	86

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\3b64fbb3a30015e1ebfa9cda6d31e8f0_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb2a9146f8,0x7ffb2a914708,0x7ffb2a914718
  2⤵
  PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2116 /prefetch:2
  2⤵
  PID:3900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2900 /prefetch:8
  2⤵
  PID:2904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3216 /prefetch:1
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3264 /prefetch:1
  2⤵
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5308 /prefetch:1
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:3120
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3396 /prefetch:1
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5844 /prefetch:1
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4048 /prefetch:1
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5692 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2104,15020530473222867596,375365365800058479,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4844 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4988

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1476

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
56a4f78e21616a6e19da57228569489b

SHA1
21bfabbfc294d5f2aa1da825c5590d760483bc76

SHA256
d036661e765ee8fd18978a2b5501e8df6b220e4bca531d9860407555294c96fb

SHA512
c2c3cd1152bb486028fe75ab3ce0d0bc9d64c4ca7eb8860ddd934b2f6e0140d2c913af4fa082b88e92a6a6d20fd483a1cb9813209f371a0f56374bc97d7f863b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e443ee4336fcf13c698b8ab5f3c173d0

SHA1
9bf70b16f03820cbe3158e1f1396b07b8ac9d75a

SHA256
79e277da2074f9467e0518f0f26ca2ba74914bee82553f935a0ccf64a0119e8b

SHA512
cbf6f6aa0ea69b47f51592296da2b7be1180e7b483c61b4d17ba9ee1a2d3345cbe0987b96f4e25de1438b553db358f330aad8a26e8522601f055c3d5a8313cdd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000007

Filesize
23KB

MD5
2f24e0f5d2c2997a89fb4a8d943c141f

SHA1
99515bde1a5bf72105116ac902ccf3db1dd3df29

SHA256
60c9ecaf27ba56d7c35aa78c329aa7dfa586e6c71ed3cdd0019ba7e767b18aaf

SHA512
0f4c5508dfdcf0ef63141df8d29c76e219d2ec433d59d37d7f17e110b455f24235fd0bc4f539ad5adc368285536d73f57dc4e21e3201dfd5753e76789208989d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
7816fe70d81699b5b3dfceaf3ffec090

SHA1
8a51959ac52a47129dff1941adec4078ce1cb491

SHA256
9a9449000d70c9e167e175d1abc8f7ace4bd9a9a3c642f62e382df506438587a

SHA512
ae8bc36ffd6b097d02904cb6df034e8ab82bf8ba160a4cf85e591a38d33b7482fbbdadbc1c1a6ba5821c06e826662a675add48018d41f69f98dfd3648b0984c0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
85d870685c58fabc75b552748a060ab8

SHA1
358880dbac6389c061ffa09718ceadf581e24ab0

SHA256
162460bc8d270a555f4191261af1271669764018ab8239624bdf77f3e5603ce9

SHA512
1cb474e70c63cf27f025ca098932e6cbd3fc4c2c5e9db15197e9e0148bbef1480a056343cac2c58bca655c1635dfdb8589b5c69c2750f2a6071bd8e6d7bee3b1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
8b8cb738fc97558ebf71c062777426cf

SHA1
4ccf8deed66df7bfb078a3a08a1cd770e7980603

SHA256
8862974e0c14eb62267ff6584ede57fcc8b56b9b6678f058dd04fdd3447f9a41

SHA512
9645220bcadf9595b95a76af5267dcf04677ad1c1ed334c7f499c86686daf5154a5990ee6e5dbe4c90fe109a6ec0ee9edb22daaeebb4e91c7c53707696bac9a0

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d4a79ef1da9f21a2158ed76249eb23a7

SHA1
25037acd7bf630d0720fc67b3ca58be03ccada31

SHA256
b1c1e798c808ce3eb80a8044c3c3a4f80c1836b907435d4ed6695a805c7bdaf2

SHA512
8756cac81ca2c29659c774ce5972b82139a4568a8c69eae83b711141ff022e88aba4f7abd493694fbb19d0a21ac025cf66b86718b28573c5f71a333e27f0f4fd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
07ab0704d0b7bbc57a12f60ae8370886

SHA1
9706dd5e9b436f6fce2674ffc6c2a7ba69879226

SHA256
6919f725ad1365c3cfd7aef0b796998e314e0d8b6addde3c7ddab1bfc08fc035

SHA512
1f8f73af2588c041ee42045e7f1c2188cc9aa588af214fc164545da411bc768d8ccb870f4fd2c6ced868734385f1427e91b365a6292b36a226f9e0c670829b83

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
6aef56f82f34af49029553e6cd66ab6f

SHA1
2788557adbbb2732aa7395a1182dd2a6b065fcef

SHA256
3e2f6c1bf23b941d121168cfe84cacf4428ed16788b6309c6b769225cf5c0842

SHA512
bc1454e5ce0263e7ea947d51984560d6f81c0a8c08e13ac2dd5111b5167c11bcb558346a2d2db8c2bd2263eb231344dcb209376e9f9ab01b580353b22a01dbf3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
05e0d7059b775e9ed0089ffdd16e1548

SHA1
d0fcd474614c96d4fd4b196af8ed7c4385b290c2

SHA256
cb2e148c0384aab7ea49d632e66c5e52bbb5d007e69003dbc83ecb4316be66ff

SHA512
52666eced438dd0c4543a26aa2128688a4f58fa932acf425101f163f956f72c21a7c902b05493f9f1fce3cadd605a332a4a77585d058d7e7c7509e53b1686b4d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
4deb933056210d1693f60025f92659f1

SHA1
b3ef0a4d507d25073640fc9d8d105787030d3ae4

SHA256
58c0701df734beaf1f83ae18c087b6035de82185224c2bc39bd8403d00cc0e25

SHA512
617233c2155799ff18658fa916714c364635552859e9c00602c7acc6bf69f47dfc11d0d12d4314c94e39e18fc0f78d5425885ed6d17fe12135b18933f26930dc

Download Submit