37c1eac271881708f02e4fa27c6f268de33b6ea9080987005ceb3c85a7f7fea6

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
17-10-2024 14:43

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5264f98e7bcc8fac61c5bfb2f25d5a4c_JaffaCakes118.html
Size

168KB
MD5

5264f98e7bcc8fac61c5bfb2f25d5a4c
SHA1

d6bfa2c378e3180f2606cbb92bbcbd8dd860fa6c
SHA256

37c1eac271881708f02e4fa27c6f268de33b6ea9080987005ceb3c85a7f7fea6
SHA512

3fe1b916da6949c334a2adb022e600dce7df08dbcae62466bc592adf4631dea0b75f67591873c7a072d842072ede9ab7d7c704ee45da3706d54a2a7791058852
SSDEEP

3072:tbUQHvMpBkGbuiYhLpOT9mjAJBhHJOEyTsFod1hynjILt9HQ:tbUAvMpBGQ

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3512	msedge.exe
3512	msedge.exe
3672	msedge.exe
3672	msedge.exe
3996	identity_helper.exe
3996	identity_helper.exe
5596	msedge.exe
5596	msedge.exe
5596	msedge.exe
5596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe
3672	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 1052	3672	msedge.exe	84
PID 3672 wrote to memory of 1052	3672	msedge.exe	84
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3096	3672	msedge.exe	85
PID 3672 wrote to memory of 3512	3672	msedge.exe	86
PID 3672 wrote to memory of 3512	3672	msedge.exe	86
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87
PID 3672 wrote to memory of 4244	3672	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\5264f98e7bcc8fac61c5bfb2f25d5a4c_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0x104,0x108,0x10c,0xe0,0x110,0x7ffc02b446f8,0x7ffc02b44708,0x7ffc02b44718
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2088 /prefetch:2
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2280 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2776 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3228 /prefetch:1
  2⤵
  PID:2328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5652 /prefetch:1
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5740 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6880 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=1904 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5928 /prefetch:1
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2044,14904039189896894851,4287996942497227678,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4772 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5596

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3800

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
dc058ebc0f8181946a312f0be99ed79c

SHA1
0c6f376ed8f2d4c275336048c7c9ef9edf18bff0

SHA256
378701e87dcff90aa092702bc299859d6ae8f7e313f773bf594f81df6f40bf6a

SHA512
36e0de64a554762b28045baebf9f71930c59d608f8d05c5faf8906d62eaf83f6d856ef1d1b38110e512fbb1a85d3e2310be11a7f679c6b5b3c62313cc7af52aa

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
a0486d6f8406d852dd805b66ff467692

SHA1
77ba1f63142e86b21c951b808f4bc5d8ed89b571

SHA256
c0745fd195f3a51b27e4d35a626378a62935dccebefb94db404166befd68b2be

SHA512
065a62032eb799fade5fe75f390e7ab3c9442d74cb8b520d846662d144433f39b9186b3ef3db3480cd1d1d655d8f0630855ed5d6e85cf157a40c38a19375ed8a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00001f

Filesize
20KB

MD5
05197e9427acea2ac4dc812f97a8f078

SHA1
3d2a38b79da52e57783360f195ac3e7c85edefd8

SHA256
7bdfd36b4f017340dbc84a310014381bfd3028416ff21c54f7ce0a35cfd38191

SHA512
084d4febc28358d3ba6b0bef400f637b7f350381b8b592b1e412dd860d5aaf034c03ecfa87a064cb19dd8a42faade23c260e35a8660791011b7e51b726418ead

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index

Filesize
192B

MD5
43d21c4439d402d710d37bbfca517174

SHA1
ec6bed19b978f415e045d2ed3dad168f619df4c1

SHA256
f0f6e672db576860da4821cfbfd6fb2241ba7e0811e40ddc929eb9295f06f5da

SHA512
becb87f3e6061abdc7549500d3d4e32b47bfc2bdfc3e42bb84c64becf442486d9b8a04e054b027d49a549ec7ad269a0a0f998a601db238ae01f9568eea66fd13

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
f7992e3eef7c274b57aceeeaa1315a8e

SHA1
5774cdb6f6ff125854c4793b6d7286d921da10ba

SHA256
f707d687ae2818a001991b41afa024818bee9f257af1494e012f36b87636a61a

SHA512
e099f0c0e79a41dd51b6fd00c1b05d03d6e9d3c00bf21340c65b1e0de631ec88ace0bbf66029d7cd175783cb462f469f81658c755bbd14721b63d3f1a5a4d51d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
2ea6dcb8c993fbb4484e0ed703b3858f

SHA1
3d62260ff62d9d81e0c97298a0582aef1f063973

SHA256
498012bf1875e7efc5300acdb0b357bb52912088c2ca63ef935cf2a9926d9d0e

SHA512
9623ecfd08e45fc079a6d5d1349c090c712e5d50699bea70f7ce5b2423c159aab77d3e27ea53e54fa5d3906463296a7b5cb555f8b7de7ef96a08113629529df5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
97545cd537c0e5436b7a65905ca41fba

SHA1
8c13ee46da3d6d0791b4b9d86a1b47172e007f49

SHA256
f52ecc853cb26e9ae7a6b803706d487069960829ddf61088db0076d749c919ab

SHA512
b554974c876320cf0d7b4b266da89c511f340d2c3457232d0bf5d26ccdf88fa3e4c1b93fdf7fce4bf71778a9a0d4deb5a090db90ca9abbb1cd695bd4bd43a8c4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
a81169e037af7dac8c941deec1724b40

SHA1
51d142b9eb115094646a961b12d34757fd32a4e0

SHA256
b2858706f93fa71ac0d1b8133d45ebd05c129e0e29e75d7ef6a0326805da4968

SHA512
6eb5c7d71f667b7c3fc9c52e52220358ef2ceca6fe7a553d64bdacb81a054e2aad501472c7b7e86063f42d1377e8cd05f46ff0603b1d35987732170d5ca5c676

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
c4d57ec42faab6c2c1f01e2f5716c7ac

SHA1
46b40756e7f4f70ad18e9cec039e3a20fb2128d8

SHA256
8b9bdc30b526870d21c344ad2a49051886d0e4e05e64ec9bc83d45422505d69a

SHA512
d9ec4e29a4e59d7837d46b72198438d387247f9cd0d0a0d79128f85f3a4c41768d6ba4ea2e22b6e4e016c6d72df21c3b0ff5a1e835ef180761a6f72cf780fa16

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
5e4e8c3ee4366faae7c11db3e66d9810

SHA1
1e1ff129ef26f23770b35ea948e04b50174a76fa

SHA256
421e366672dfc6f67a8d31a3232d53f039d15b89e5b95699c905d399adb107fb

SHA512
31e6bf03b4bc98de17e8aad9003c45db87940066988b6c2eaf981d1e54a2bd01ac2f189c3edbea2c40a9c9dcefe3611fbd25aa5b8abac521e0a3c15390c12c06

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
db6381fbbf02518a35b3fc93e0646a3c

SHA1
b6ce9d8c23278cd2f7403d56d231d896c006e0a8

SHA256
b478b8b7efbd8f4dab9e7f4ffe82a88e1925e91e4d1d1ec91364195dafdf4807

SHA512
f8dec86156cff2973c087ec964ba994948231dbab10c99dccd388c831eeba71035f6b7b916d4f500d0f781c3f8b9fde7bd7adc6209471c3ae7d17c3308d92a1b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
64d5dd7095af7edd1880b4a89f19a564

SHA1
a83ff5f241fefb152a7becd293b8df5d1f25f14b

SHA256
9ab2dbeabb7ac360d44dbc564f2dec3eb00d87591c3354092138a37fdae8cb24

SHA512
5d9a2dd1161986e0b6962dd03c355a3809190d959c87efca0d97feb51a8561afd43474658df1728e6cb08c3f41ea3032b962aa2a6d348d2e25ef9839771af2a5

Download Submit