1e969a4dc029ed074d5498b15dfb3c4b2fcc1969773dd315e9ab6ca43831da25

Analysis

max time kernel
145s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
10/08/2024, 03:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

84917f72b764248a0a3aebdcb06355b3_JaffaCakes118.html
Size

150KB
MD5

84917f72b764248a0a3aebdcb06355b3
SHA1

e5a8aa16687ba70ddaaa288aa3252516c566d995
SHA256

1e969a4dc029ed074d5498b15dfb3c4b2fcc1969773dd315e9ab6ca43831da25
SHA512

8e83f2c6d59b54174195561b56cd113a6d78bca432db82f76ae1c1f1c2f41abbd86b03a189bba4505045422059570569261b75f746f364909447619eeb74e2d2
SSDEEP

1536:XkclJ/xnffvDVFkDOSo6GMW2TldA8M/v8RsPUVfe1bUAk73KclvJp:XkclhxfBFkDOSo6GMWi2clvJp

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3856	msedge.exe
3856	msedge.exe
3528	msedge.exe
3528	msedge.exe
5028	identity_helper.exe
5028	identity_helper.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe
400	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe
3528	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 3440	3528	msedge.exe	85
PID 3528 wrote to memory of 3440	3528	msedge.exe	85
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 4880	3528	msedge.exe	86
PID 3528 wrote to memory of 3856	3528	msedge.exe	87
PID 3528 wrote to memory of 3856	3528	msedge.exe	87
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88
PID 3528 wrote to memory of 1364	3528	msedge.exe	88

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\84917f72b764248a0a3aebdcb06355b3_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ff9657b46f8,0x7ff9657b4708,0x7ff9657b4718
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2072 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2228 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3204 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3240 /prefetch:1
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4880 /prefetch:1
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5460 /prefetch:1
  2⤵
  PID:2544
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5436 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5608 /prefetch:1
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4960 /prefetch:1
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5680 /prefetch:1
  2⤵
  PID:680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2064,5126867593121072286,11279968356728406307,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5260 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:400

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2208

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4616

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3604

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9e3fc58a8fb86c93d19e1500b873ef6f

SHA1
c6aae5f4e26f5570db5e14bba8d5061867a33b56

SHA256
828f4eacac1c40b790fd70dbb6fa6ba03dcc681171d9b2a6579626d27837b1c4

SHA512
e5e245b56fa82075e060f468a3224cf2ef43f1b6d87f0351a2102d85c7c897e559be4caeaecfdc4059af29fdc674681b61229319dda95cb2ee649b2eb98d313e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
27304926d60324abe74d7a4b571c35ea

SHA1
78b8f92fcaf4a09eaa786bbe33fd1b0222ef29c1

SHA256
7039ad5c2b40f4d97c8c2269f4942be13436d739b2e1f8feb7a0c9f9fdb931de

SHA512
f5b6181d3f432238c7365f64fc8a373299e23ba8178bcc419471916ef8b23e909787c7c0617ab22e4eb90909c02bd7b84f1386fbc61e2bdb5a0eb474175da4bd

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
312B

MD5
e337741204bf67ca956f1dcc9bd6ad6d

SHA1
a6d518ea085ebbbc769649b8d782b6b414bae528

SHA256
8182ed82cbe6e2b2025c5f079415eb8c45e020e58a7298a3a52066d353585b2c

SHA512
3f32bf2f94e664abacbeb808bf2e498a39fd4beea7a48302a3369fb29ead8b40cc47b99c0abe966527ea5f370e5e547643e707df7bab4e37227b5ec97be75e28

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
225c9177c5a393204beb99374aef5d14

SHA1
db3b8025329f9e7842fbcc1360459792cc6c0028

SHA256
7851bf3abb89ac6c4be28e4b99e2bbed877fedb4b9f2c4737c2c5d94bb13c55c

SHA512
b7975b2b4db308673eaa1589c74c9e345d539d7950f8ddff10cc246b4cc576de8dbbc699e87a62d13cc2f252a4da4e9df2ad344a8825860ff1ff18d65bf98fd3

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
2KB

MD5
b2ea182dfc0df3d137988a9e9c2f55cb

SHA1
2c242308917c3d432f1b952fef4a388401049ac8

SHA256
8f106f6cacd5d5a77f7c45bef43c2657f291539279f746c7498339d3ce7cd6fd

SHA512
7066bda1838347526a3a5542493aa33cf7b16913f7499d0f9f73586cb806179e14b1706968acb38b60ba3524944ece493f4ad3037c935c5ad3c9d7e3a1ce8367

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
ce7fb5f7450883693cb30dbb4d5e60f2

SHA1
047364f655e57a439793b84cc0a60f119d91eaa6

SHA256
1e448ae0a47d0a738de7b33243a9d5892d081e5ade7ff2c75441126a0b620907

SHA512
a79ab033922520e5b20960d74e7e81cc3cdd60c09b7f6e93044fa9e6d93c0b6ed14f2cf0c8ea3d541ee75344530067113443dea33bf85b2397c7fc13074ecf86

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
32d44f125ab22f3906da337334de21ad

SHA1
98349d74bf3ec62e97ae1f231f656815c09da886

SHA256
01fc0eb26ca09eb1f9649cbd767a0ac4b9fed402adf13eb47a314689c2836297

SHA512
e21aaf23d52a30edf35a432883f1405fec3856f530721766d25cb51a2e32aeb507893fed01bd23981fe4082210a6e6f08b8b2ef9126bc042252890225c434273

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ca158bf08c5603214730895e22b95a69

SHA1
93d65ca21ad9b383b5d3e295279e0857efbd0383

SHA256
2c0240b6a42172cd8b6ee97139fb6cc3a451659fbc961d9bd9debdebb208f441

SHA512
67d82392c1931ec4cbb9ba8755c8655819dd261e17702fcae5f3d0e9e376de946ed313af44207c06edc40f099368b89921dee718af5213e293a4f1194c1eb64e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5d54df02f15aedc1979a4605861b1699

SHA1
f4af809dd5f0643ddde16a3ca3c46e270d5fd8ab

SHA256
8f8d99b3444a09d612af5889f64469296693f8cd79d7ec248b6e623118144cb0

SHA512
e88f6ad83246aa74e5f53ff6053bd2ebe12f44fd9540768d1dd0a36157c824219802cd07250e3742ca4f4482c5d9a8953ae9466f617bc1c0ab69ffeb82793ffe

Download Submit