99aad602e4f87a16304bafba3d936679b2cab03e01296f21b8aef3c1811297f4

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14-10-2024 18:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

438e3ccb9dd9404162901824130b8572_JaffaCakes118.html
Size

199KB
MD5

438e3ccb9dd9404162901824130b8572
SHA1

3e72474796535513bf876dfa72bc09f2b66f3c2d
SHA256

99aad602e4f87a16304bafba3d936679b2cab03e01296f21b8aef3c1811297f4
SHA512

262702482ca2af03a2aae425ea4422becbd0f47f637057460301858d37a16650f03384a7d820777f2947b8cdb41c4d6bf69cdee6cf407b1e7785299933c1f74d
SSDEEP

3072:LdtqlgjUa9sB/nCXAOw+R67S8LR3fwa1hWuykxlP7eLQv:aAUamB/nCfgv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
440	msedge.exe
440	msedge.exe
4324	msedge.exe
4324	msedge.exe
4400	identity_helper.exe
4400	identity_helper.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe
4020	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe
4324	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 1576	4324	msedge.exe	84
PID 4324 wrote to memory of 1576	4324	msedge.exe	84
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 1696	4324	msedge.exe	85
PID 4324 wrote to memory of 440	4324	msedge.exe	86
PID 4324 wrote to memory of 440	4324	msedge.exe	86
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87
PID 4324 wrote to memory of 216	4324	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\438e3ccb9dd9404162901824130b8572_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffb29d246f8,0x7ffb29d24708,0x7ffb29d24718
  2⤵
  PID:1576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2428 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2652 /prefetch:8
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3136 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3148 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4916 /prefetch:1
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4976 /prefetch:1
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5696 /prefetch:1
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5772 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4024 /prefetch:1
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6384 /prefetch:1
  2⤵
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2052,14814096369219907816,16211518524865075518,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=6124 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4020

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:1852

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2660

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
e55832d7cd7e868a2c087c4c73678018

SHA1
ed7a2f6d6437e907218ffba9128802eaf414a0eb

SHA256
a4d7777b980ec53de3a70aca8fb25b77e9b53187e7d2f0fa1a729ee9a35da574

SHA512
897fdebf1a9269a1bf1e3a791f6ee9ab7c24c9d75eeff65ac9599764e1c8585784e1837ba5321d90af0b004af121b2206081a6fb1b1ad571a0051ee33d3f5c5f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
c2d9eeb3fdd75834f0ac3f9767de8d6f

SHA1
4d16a7e82190f8490a00008bd53d85fb92e379b0

SHA256
1e5efb5f1d78a4cc269cb116307e9d767fc5ad8a18e6cf95c81c61d7b1da5c66

SHA512
d92f995f9e096ecc0a7b8b4aca336aeef0e7b919fe7fe008169f0b87da84d018971ba5728141557d42a0fc562a25191bd85e0d7354c401b09e8b62cdc44b6dcd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00002f

Filesize
23KB

MD5
8b41d9e82bfaf51825f94b0bc9facf25

SHA1
9f988a1b5c14425843d77bccca491b419f115816

SHA256
c0396130b9807c0b45615aefc58fd118f64899622a1a15e5ee6a88ae3516704e

SHA512
9d1caa1f3fea8e19eb0b8dd6c131665d826bbe85327757f4469b3e41c3c5dc77b5f3ae8bb2360a3979b5607933f7d5f7064abd1f196f7729e4ee90b23571c011

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_000036

Filesize
45KB

MD5
ede70f717200a59b4cb831635de913a1

SHA1
d4d6e893ac192b5df087e924ab3356852f8a7bc0

SHA256
c63fbcc69de230e4844cf735ccf668eeaf30e42126eeb464da39c2de6b0b0051

SHA512
b621bde28b90ba97c122677989d994cb5e88fd0906366af1a23ad3f9d9f3b7f2bbef95873f29100433d4068fbbf7ab798505e68deefc118097fc5f76dfc4b672

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
384B

MD5
4f66e9dd69b4237d6691ef0c017865b5

SHA1
464c5b9148b9691385766fff81906ebf909aa4a8

SHA256
b1ece635af0d10b2ddc512d50a81a8e0bc2c9adf1e11c632405467abe96dbdeb

SHA512
009bf2009e90b22cb56f60945c5523cff63d56cd81b775a3b46f17a72e983ba112dfa33210172390b946f9d5a5402a1ce78b5efd94a90a4e20b4677507edcb42

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
ddb8f9510d46850458f6823f69932bd5

SHA1
593b5f3973063bec3eb365c59c3e6ba4ca675238

SHA256
fb21e200594e117b07bc80c3f73bdff16e6c4f6ff9d37bf48eea4800df3f381f

SHA512
4af7d30a3aaf79f28a3a675b5cdbf8100b2118e3b4be40c16a096d2518918cef0ba32ad8dc489e8d2c0f9381a068a9bfb4e6121c51d39e0be467a06e684f113a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
3KB

MD5
2c211340d1dd63d4965a7261c0833089

SHA1
4a5df58e543a68fa57ce801f32d5d6724df69910

SHA256
8fae24dc48f8d39f6b40992077f83b9a20abbdfed2dc157fc7929b6ecc488c32

SHA512
5ca95606b3f4ff39ef5b7e40788fca7906b4263c5fb7fac711f984c7655ae05124c22935cf7ecffdd8b1dcc295db0fc45486ba653fa87478a18f9d3eb854980c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
6bfba7d9cf4a8d9c816ddd08aff652c4

SHA1
5a0f5459f22a6962c4bfb1b0b747cf8d549359c0

SHA256
f639a739756e74cbce1075a07d99119a5c7c69237e32f18409db5793dfa4d556

SHA512
35334d431cdd13526910d7be8fd7814c466e37aec7a2606825c2ca701022ae2115676d7b4d959bcff25aa8562b6cee56513cc7f7c5a1dd52a1b1903945322a59

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
8KB

MD5
277ceaf3cb9e9dac2f1eb3d573dc4383

SHA1
dfe2d0f6d5508cd658cc5ff7a97463950f4b8861

SHA256
d1dbf4dcb7da917d9800e588ddf10431b2d7e04be2d07d3d8501a66e259ff8b8

SHA512
52fcbbf27530c49f30f3715be8655602e8a7efbe8150d71c2476ec59d0c66728a2368187a346e9b5ba3fccb0b69bcab53fa4d53e14bee2fa393b4427508932a2

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
c9f8378464353e8caee03087cedd37ef

SHA1
ea15ee27ab5a8d68668c73344198637379fcd1bf

SHA256
7a4c6d50eda8ebcb48b94fa94dcd4ac3f6f648bd0c55baad5f735a3cb8f6ca86

SHA512
0c327e122c8f8ef460dc687131ae6b3d81524dc8b272920dad85226c5a9e1362cd97d83a7bfac9d5389e56383d6cf12b6abb7e506e6a1acd97f02eda59762e12

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
46295cac801e5d4857d09837238a6394

SHA1
44e0fa1b517dbf802b18faf0785eeea6ac51594b

SHA256
0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443

SHA512
8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
206702161f94c5cd39fadd03f4014d98

SHA1
bd8bfc144fb5326d21bd1531523d9fb50e1b600a

SHA256
1005a525006f148c86efcbfb36c6eac091b311532448010f70f7de9a68007167

SHA512
0af09f26941b11991c750d1a2b525c39a8970900e98cba96fd1b55dbf93fee79e18b8aab258f48b4f7bda40d059629bc7770d84371235cdb1352a4f17f80e145

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
6c74e3a4274e3d9576f1cfcd4d83f103

SHA1
d2874e326b1aca012a27cab3d64b21e4d3782c7b

SHA256
571ebefb1690a6d7765bfec4539950f9a830daa63db350040b8c5ba1cdc25a93

SHA512
58262643a00048e411226f29aa1da4afada80a6a39c22600523d5960f3b8390a272f7530c2fce431d6e2107b5e6493cbe23891f33f2b771688e91b13147d1cef

Download Submit