0fe989ef1bb7505ea0104c83c8232d5131d2dfc22a91eec8481aaeaa1753819a

Analysis

max time kernel
145s
max time network
140s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
11/08/2024, 14:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

8aa49ea8be0dd6abe83a0b220050ff03_JaffaCakes118.html
Size

320KB
MD5

8aa49ea8be0dd6abe83a0b220050ff03
SHA1

162edfe94257a4a2d14e7eb2436aa43c9f0cfa87
SHA256

0fe989ef1bb7505ea0104c83c8232d5131d2dfc22a91eec8481aaeaa1753819a
SHA512

38973b7a5a04181515bbfcf6619ff1151cf6468a8f1eea72571c7b5031bf5d20fdb76a1088bac28b3f00fbbc6ecdb1b20fd5061ba8835c7db9869cad9bd689cb
SSDEEP

6144:3NWLA+6EDRXIwR4APstuyvmE5urBfPGSudalMJ3jaDEiaDadH85Q1Zg7h/Wr3WAI:3NgA+RXGmE5edH859lW6L

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
4892	msedge.exe
4892	msedge.exe
5104	identity_helper.exe
5104	identity_helper.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe
1112	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe
4892	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4892 wrote to memory of 4852	4892	msedge.exe	86
PID 4892 wrote to memory of 4852	4892	msedge.exe	86
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 4200	4892	msedge.exe	87
PID 4892 wrote to memory of 2112	4892	msedge.exe	88
PID 4892 wrote to memory of 2112	4892	msedge.exe	88
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89
PID 4892 wrote to memory of 2100	4892	msedge.exe	89

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\8aa49ea8be0dd6abe83a0b220050ff03_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7ffbda7c46f8,0x7ffbda7c4708,0x7ffbda7c4718
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3300 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3312 /prefetch:1
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2016 /prefetch:1
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4668 /prefetch:1
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=2108 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3348 /prefetch:1
  2⤵
  PID:2376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4108 /prefetch:1
  2⤵
  PID:1212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5424 /prefetch:1
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2112,10325794616345562756,1069340512290103437,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=1120 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1112

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2376

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:312

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
d4829218222c8bedb9ffe89dffd37095

SHA1
aae577f33f413ec3d09f2e7ff5d9cc20a602241c

SHA256
49239b229a2519583ba5d6de3702480b8a8ebf3cfaa8945100dbab25fcb02b7b

SHA512
03e26a2e3de41b8a829b5543da504c7d7ccdc4c112d629efcac24dcda23acb50a52b5b99572b5efb2a01cf392a457cf9fac85663b3d63f7606be00dba218f8f1

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
15e9c4b4eefb3e1c08a010e748e10f58

SHA1
3172378f2c7a00553ce086dbf53fcf3126c5a724

SHA256
07b56a769467e8b57f9b7acd9d32da266ca5000803758c18bb6818ac236c7000

SHA512
811058b539e914a812c88543bb6657de736f691d18d6dadb5e1f6ced286780fb334dc5f575babbcf4fd2dceda30d1bf4004b374c5775e7f278346b100b29eb7e

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0561b798-1248-4517-b2dd-33ec730caf75.tmp

Filesize
1KB

MD5
555c1695f56f658221c6d5d0a6397e6c

SHA1
a72caf64fb5a54beb3113d3fbe1de7ccaad441fd

SHA256
3663efc1020e4481812d5d0f1ec67b36d90bacc4e6444ce62192466850aa10b1

SHA512
2c5f81c45d84f7e2d9c1b75c64e818394dc3f0dc0bceaa11cdd11cf642190efb620039e9098bd9b460d7c796adb54b0b4e75eb5c3ff9cf20c0e8739f438d9b92

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
b7faf4926596393cab37677e970fc38f

SHA1
d3d76cd477c990f99f3d0e7cf310ff5f7222f6cf

SHA256
a9349d6c27105d4e7ec0b49c12fb48b1b02b5a369d540a01f84a7f61707a15d6

SHA512
b6f13f1b8b5c0a1684f69da1e50eb69f006f62b829d0833fa4f281ea332c411257c6e50ca57ee00ae2e2e21de30f601515fd9e530674a0eebd1878bdeb555d35

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
facd477b002b894511abaa14abdddc25

SHA1
539bde05cc85043f9bff957511c3b2216719fdad

SHA256
12ca5eb2fcf12163ac78a112f48f78ea2d0775b34c5fbc62b25158615ce87ac0

SHA512
a800b229dd828e9b8b73eb29c7e081930edfd4115cbb2fb06bfd68f2be44b1e59ea0e73d1b3cc91ab9696eaad482e09be7534304bc443c840a796078a069f74d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
eb41cd31b71e9fe38cc4516ceddcdfa2

SHA1
420b10e51cf5bab45fb69a08563e472e46caff46

SHA256
aba6d75c8afbd4dec7c7a0c2c035d3f4f023c61490aed7ad114f853a47d3bf91

SHA512
4310a71d451ceaa0c16b813c5806e463300682e8fb46ac8c8f40f243e7d1790e23702750ae05d9acb4a87201af85ec212f3c3d73bc257b0e96582e4a6a81aa3d

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
d83d1c59997cd4d8052c1a17cc793731

SHA1
70a84e63a3297f435fee897ab2587b14e828923f

SHA256
980458b1668f892fe2c59db28d0cde9f76b01534c5aee5df8b2c3b9a0e0bc9af

SHA512
033b53725aef57c708d6e4b9dfe52e0f8af21a083f64edfce40c56dfe39fb9500033d8e25d664df81c359c3207f3c45f3f7ac3208897ed995898fd7352204495

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
4e3c066877bcf9617db463294025a936

SHA1
b140114909d44d78f1bf75b75a4cc333200ffbc0

SHA256
58d6203634d4032a5b0031f4357988bdce7a2518ff08f5dbd14b9b0a7521388d

SHA512
1dabbfcff58d711c28aa59db149b61ca702fc0837488f79a9dbd30e9db6ce92ee27c4458df3f2b98d4eef6fd5317579043a1a2e7a11d30256f55785b704669e4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences

Filesize
24KB

MD5
7915ba0545666aa5833cf9f9f86d45d6

SHA1
743ecc319bc2a54973582d4a5198042a48fbe8db

SHA256
f8fcc045da13bde0f5dec3ada86342105cbff34ebc2442bcf51e8ed509a95b20

SHA512
a53036251a22cdc95579ea8641c5574f1dc1f7dfd0390f00ebeafbbea0c1a2c0c3e6dba23bbbb8d8e2c77a3e1e816ccfaf84a97da1c334019c8df1414999d1f9

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
37b9813671fccf7256daa85b65afe724

SHA1
0376c446ac147c74d69c3a6717c20192430d719c

SHA256
7db52582f0c7ce217f660990c88cc445bc63844b88670cd1e86162f8ba964b9f

SHA512
2e2317a7551980f9c97d059db6623b0b8101603d95cc9018f840cfc70dd0719c61ea78b76f1f152c07fcb2cb1f28c7b22a4996f9a19c7fb8bd0b34fce2c85308

Download Submit