2e1308843c80a0e94da8e5f3ab496d116f7839d9a8d0a7a6d6013359bb2ef8e3

Analysis

max time kernel
145s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
26/05/2024, 20:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

76b8ab7bb0c286bbb4c927cd65b66228_JaffaCakes118.html
Size

41KB
MD5

76b8ab7bb0c286bbb4c927cd65b66228
SHA1

40fd9d89628d43bfa09a243b1135a2129a856945
SHA256

2e1308843c80a0e94da8e5f3ab496d116f7839d9a8d0a7a6d6013359bb2ef8e3
SHA512

aff35b9aa3a7b1821c1f901358b2f348d561baf86b51f37fca5dfa1bba2d5b4ec1f67b9b634f130721dcf0d8a09edf299671e3ca36e3a3658af1f94e376bc801
SSDEEP

768:o3Q53Xa1vQ2Tk67Gb5cFXGq4xevEG7GQ1I7QKEd028qYJ4eesQGc1KDunJu:wE3Xa1vQ2Tk67Gb5cFXh4xevEG7/IREa

Score

1^/10

Malware Config

Signatures

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4628	msedge.exe
4628	msedge.exe
2624	msedge.exe
2624	msedge.exe
532	identity_helper.exe
532	identity_helper.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe
4432	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe
2624	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2624 wrote to memory of 2176	2624	msedge.exe	84
PID 2624 wrote to memory of 2176	2624	msedge.exe	84
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 2884	2624	msedge.exe	85
PID 2624 wrote to memory of 4628	2624	msedge.exe	86
PID 2624 wrote to memory of 4628	2624	msedge.exe	86
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87
PID 2624 wrote to memory of 1952	2624	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\76b8ab7bb0c286bbb4c927cd65b66228_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffaef7f46f8,0x7ffaef7f4708,0x7ffaef7f4718
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2028 /prefetch:2
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2404 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2892 /prefetch:8
  2⤵
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3196 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3220 /prefetch:1
  2⤵
  PID:3888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5100 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3744 /prefetch:1
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=6388 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5428 /prefetch:1
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5944 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2040,8309360815911041855,16085964518021006572,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1368 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4432

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4560

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
ae54e9db2e89f2c54da8cc0bfcbd26bd

SHA1
a88af6c673609ecbc51a1a60dfbc8577830d2b5d

SHA256
5009d3c953de63cfd14a7d911156c514e179ff07d2b94382d9caac6040cb72af

SHA512
e3b70e5eb7321b9deca6f6a17424a15b9fd5c4008bd3789bd01099fd13cb2f4a2f37fe4b920fb51c50517745b576c1f94df83efd1a7e75949551163985599998

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f53207a5ca2ef5c7e976cbb3cb26d870

SHA1
49a8cc44f53da77bb3dfb36fc7676ed54675db43

SHA256
19ab4e3c9da6d9cedda7461efdba9a2085e743513ab89f1dd0fd5a8f9486ad23

SHA512
be734c7e8afda19f445912aef0d78f9941add29baebd4a812bff27f10a1d78b52aeb11c551468c8644443c86e1a2a6b2e4aead3d7f81d39925e3c20406ac1499

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4c5ab905-5824-4f72-92e5-846cfa5aad91.tmp

Filesize
7KB

MD5
498528e579d1ae386af42b355673eb6a

SHA1
4dee975bed96c26a25f8c3370d5f34b26360e822

SHA256
523b753ea2714bb6c0a6488f0271787cfbb7f338c0563faf29609e30d5cf613e

SHA512
faedacf69443d3b0b82c2ca592e3a422105b49faf14d96d43f70b164c9c33f16518eee1390126eb9121e26dd731abe06a0f99b271a4e122098b1d645b1571601

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
217bcce852dea83c3363d4475e27f363

SHA1
41abf659ace035a732828e204c8c07484d2118c5

SHA256
79b191433bd4bc3d3869ae2752bf237df3ef8543d3d22c38829ef45fe28bb623

SHA512
6c004140e9e788e730f9c56b62b6f1cdd607efe9119617efc9cd1ba3cba764e438b02719aadef97e386ca3c46a0f7830c5788548106f9b2b92d0a51fbb525b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
168B

MD5
8c1f41566b98d8f2cd347baa155f0ce0

SHA1
f8b143bb609c5c08bb7a8c0eb7f3c7456dd92fc3

SHA256
8d8cef0f76a18052412d5ac6b4b0cc3c6f8b4cdcb67a812e028c105c9feb0084

SHA512
8d9d762090fb7f7cc9f0fc8858ab6505cc021f475e9e823097cfc25e7a4b9ef5518fadf588ccb47e744a097b36662a14161f92e50bff2b70b725bde56e1a4a89

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
c9ea31ff56c510ed47a4910b942e0aba

SHA1
b9a878d18e3379181c330d1f97fc61679acb3297

SHA256
295f409c307b6c82692537928a60a8f133f69764bf07c115d24535ae8c47e74d

SHA512
caf5283b9657bc0adf3646c930d7d6a9d36f375128069ec4bb137903f738da48414d10612a6ad3690faf4ca27f2d5bbf55a13ea6bf652af947124a24704dd8af

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
a9fc2273be57685cc720ccf48845d8e3

SHA1
576daef1cbff3556f3fa6c57dce4ea5eda67ef37

SHA256
101b8b88d4c2b1d3a7cdea46bd32de422edf0fde41e1752e2d4ef748d9e04338

SHA512
70194ecdb00615a134f3f5d0d07ef506701af6af87cb3c4fb47b63381578ac3b007662a56bd85247acade549783a4ecaef70ed1f38eb8ba1dbd25162eae917c9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0d03a3c3eeaf9965169e28dc8cdb58b0

SHA1
0becaa3acba13ea4ecb6f6909456c9a2c69e28e7

SHA256
7f6bfc50d89bbbcdc98032b0d212228dd434f3661c19f1f5019dfd385c35836a

SHA512
3c5a79cb67e484830ddb564082bb4b09f3ffc81687345d26f11972ea6f5f856e8dea54f2b4d7fa9f862b7ce49ab0b99c4722822da96a387f4c8243a3d9c28fad

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
7ee3fd696d419e0a23c115cae35487c3

SHA1
eef0ce6022185fb6794cacc65459ed8f9b352237

SHA256
a4ec67f10ad2eb2b34f836e24614353baa8316e9087c7a4e30aad4825cb25245

SHA512
b85857ceac1ffc4babafc447c039a62dd1ef1f688c86868dcc45f9f4d19ed4e08c8e6a82035059d0dbd72dcf69d9c4b16f198f469f5f9ac9288150e3649f4d82

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
2a8ebe81035b7e33bb178a84a5870a3f

SHA1
b3c75b7742d5565540c352f1c78cdc22ea8da24b

SHA256
53c4278f5dfb71c7b4781a724080e830162ecd7c2fb33a75ea06062a47c9bc9d

SHA512
bc77ad5e15f3514509f9539f0c96ec7a49ba1a89d904de59526e53987e0502a8df3fd1709483f80a830ad88d8c906cdd181b57438e8e825d3a5a3d27bbf3817a

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
11b3b8fd535135663ce529307ed6ce69

SHA1
5a30b8f2d1c1f8b5379f17afeee4d6cf91c9f42e

SHA256
d8ad4bdde02337253d0e6add3662692531d54afddf149b5923831110366f8465

SHA512
a56217e1934e4507ef75051fe8b974c2ddb0657434f675011fb7ae9d8278786c3fe161fa16cd637cc56549c3ba5c9bec2df0153ce195dd54b8ba48c86c040c88

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
11KB

MD5
04c7e7822a35a1a6c84776757686c9b5

SHA1
2909d237ccdad103b3a52b8fcf78cf2104db2649

SHA256
f31b28f3f8226a054a79edd805e25729b9cd7d91d26f24ea71571a8e19bfb817

SHA512
d285dd14f0734bd0574ed40710796ed31804ce6368a16f31b9fc8d40bfe8e6c085fbc233c70d980c55f81f04c969b9cbf7eaa32a13b86164c86b27b8110d7774

Download Submit