0983250b2ed4c3cf184f871281f75f726122d6d869acdc1024457f02272d2a0c

Analysis

max time kernel
145s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11-08-2024 00:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

883c5c7b3431c21b1984f00a4afb234a_JaffaCakes118.html
Size

57KB
MD5

883c5c7b3431c21b1984f00a4afb234a
SHA1

b3f8896165709e2f3b7b1b006c6013e247e69f8a
SHA256

0983250b2ed4c3cf184f871281f75f726122d6d869acdc1024457f02272d2a0c
SHA512

1ed50e26e6330a4bf378f17efa57acb0890a099d991218a6a4b648e9b0d857d78f514adc69dae419239703af0407a439cdc0ee4bb5cc4f5dfa394b3d654ba023
SSDEEP

1536:/heOWA4uK/HHXCq3WWFu8wehiVUgbdE6nje7lhtAXtP8MKSPFNVVTn4IwHpFV5l7:5b+x/H6WFu8wehi6UEa+lhtAXtnKSPFK

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1820	msedge.exe
1820	msedge.exe
1488	msedge.exe
1488	msedge.exe
1656	identity_helper.exe
1656	identity_helper.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe
5924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe
1488	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1488 wrote to memory of 3444	1488	msedge.exe	84
PID 1488 wrote to memory of 3444	1488	msedge.exe	84
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 4192	1488	msedge.exe	85
PID 1488 wrote to memory of 1820	1488	msedge.exe	86
PID 1488 wrote to memory of 1820	1488	msedge.exe	86
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87
PID 1488 wrote to memory of 740	1488	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\883c5c7b3431c21b1984f00a4afb234a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffe9f4046f8,0x7ffe9f404708,0x7ffe9f404718
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2188 /prefetch:2
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2240 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3232 /prefetch:1
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3244 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4776 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4152 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5576 /prefetch:1
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3164 /prefetch:1
  2⤵
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2968 /prefetch:1
  2⤵
  PID:5356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2176,4715722754557322345,7290833861965164000,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=4920 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5924

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:3700

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4416

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
9b008261dda31857d68792b46af6dd6d

SHA1
e82dc88e2d1da2df7cb19d79a0346b9bb90d52b3

SHA256
9ac598d4f8170f7e475d84103aead9e3c23d5f2d292741a7f56a17bde8b6f7da

SHA512
78853091403a06beeec4998e2e3a4342111895ffd485f7f7cd367741a4883f7a25864cba00a6c86f27dc0c9ce9d04f08011ecc40c8ae9383d33274739ac39f10

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
0446fcdd21b016db1f468971fb82a488

SHA1
726b91562bb75f80981f381e3c69d7d832c87c9d

SHA256
62c5dc18b25e758f3508582a7c58bb46b734a774d97fc0e8a20614235caa8222

SHA512
1df7c085042266959f1fe0aedc5f6d40ceba485b54159f51f0c38f17bb250b79ea941b735e1b6faf219f23fe8ab65ac4557f545519d52d5416b89ad0f9047a31

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\f_00000a

Filesize
21KB

MD5
c3a1bf5fbff5530f55ad9f9fa464f25c

SHA1
449a621b775cbe1d3ab69c54a0e18c0ccf6d6caa

SHA256
4ea6b3a39d794db93d1084770cc340272f8e5ffd5cd8d0c05c1f5841e5dc13e0

SHA512
75aa617b33be2eabe9f67166d14939d58abdb2396b9911dc7ba612130d2ba9adfc90a3cc9b6de4dd6cf8731c90f2ca74b7f9cfaf4a9d0bcbf90d03c907e45a54

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
fc77743abcb4bd2be98aa623b19922e2

SHA1
f9e29584e47ac68f790da1efdcda110604777d54

SHA256
c49c097963ab931fa74a6fd06107b86933b9b57becef5389787aa211c7d07d65

SHA512
78e43884e58e9902b4901ef0c5e64207c27007594e6d68da0442b297ac1c2c4714aaf8e0e0af475f2cd78782b22c143a85da5d55b06b19ba83399bd119869874

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
96B

MD5
90f886f680351dec565a4deeb5008232

SHA1
910db420c08623299a9f07754724ae2a93f7bebe

SHA256
5ae570f7722f892294afa6ee9b4745cfb741e5e674fc47fef55f14aca7ef57fb

SHA512
a9a6a13929e0819a06b256833f821d7055ca31374a2177e631ca1440302d3284deb64feb046384f9001269df06f787582cc88374fbf8b5c10aaff155551868c5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
c0a0f4a2fb46052b19d1a830a2b80838

SHA1
8d880464f57765fca003a880b38149d52613fb48

SHA256
c889469c34c220b0ce8387f26291ee4e77028ac85853c0a12315c2e29805a175

SHA512
9c8abbc20bc594292831a169a626167001cf032caa441b2e7a94b21f02ef59f83262e8f289589cad77ff5e66747d292edc1a8c159a453103ac0fdee6f2af1417

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
cb32dac5c386fa1e16262ac608413e30

SHA1
0cce6b0fd2893d8b12a2a432f61a3e20db57136b

SHA256
dfadffb35e4d7ae21ef5fe96754e1768d0b52055d27fc6f717ed36b9f663462c

SHA512
92450ee5f279ca7fc1c4ff96b4158bc672ac1668595996bf450832c85ffadc92be074c56a937bbc52bd596ae372607d4ed155aa1b6cdd87332f07f2d0f629d0c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
44f766e593c56b8a87cd35a0b480fd4f

SHA1
d55f8df2d872938770d333fdfa81fbda1de1b372

SHA256
b25734d1bd3ab557244c00a3be8a6fb03e7047ad957d6a4a3e9db0f491adb1bf

SHA512
2a24dd38a40df235f3fccbe59c102c51c4e958c96031ca5dfcb1858765540259a6e1a5f8b3910c8b03aafcfbcacf4c8ff5ee486b7560fd1cd643557e17e59f73

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
957b6a7b6ba81ca27b0de075ce2379d6

SHA1
0ac8e3725b72123362a5ff919517f8a0a9d99900

SHA256
547b822f39b3dfdbbc8d151984b8d577df5bfceceb97a784c080626b6e881841

SHA512
1ba70e75f93919a32dea4c41321709502a39b5d6e884cf689446890ec96e42ed5a77a1c4a7c6802537919cbb48a924f71848593ca8691cc1d195633bacde9386

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
5b22af79eba297d71a1f564eb0ee37da

SHA1
3eab19b4bf034192718b42f8fc75de6842212894

SHA256
f342ffdbef76dda2284819569bf5bd4e5b49c7fac311544604c96361f098c0bb

SHA512
618692e22ebef84464babc9585219afe7242150ac0a24c9ddf89e97a510d558205512ae28d4c0d5658fcdec3655d9bba764309829f6fc0d8991c2aa39884acb9

Download Submit