04800ad4f55d8d21bc2f048601261d5d603bce443b72916fb102892ca8e123f4

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
25/08/2024, 09:16

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

c06b7c40fa8c10dcdd47eb75738a189a_JaffaCakes118.html
Size

41KB
MD5

c06b7c40fa8c10dcdd47eb75738a189a
SHA1

e501f3f35b8394f5a0a9de7f1a3956c63b959772
SHA256

04800ad4f55d8d21bc2f048601261d5d603bce443b72916fb102892ca8e123f4
SHA512

fbaaed365c28508513782682c1d450f8a34d4fe4e7aeafde0cbd12d86049502ff0b8e4d8ed57b238619e8fff50dbf94b74f5df7abaa0f3ab49fcc37a02427cd5
SSDEEP

768:2lk4NfQAyOwgIGG4OGmwsamde+MMAbVLV9FqqiGULZ/7ECLE7KT1Z+482EgZh8h0:Ak4NfQAyOwgIV4hmwsamde+MMAJJ9Fqd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1604	msedge.exe
1604	msedge.exe
3820	msedge.exe
3820	msedge.exe
3264	identity_helper.exe
3264	identity_helper.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe
2748	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of FindShellTrayWindow 25 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of SendNotifyMessage 24 IoCs

pid	Process
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe
3820	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3820 wrote to memory of 1044	3820	msedge.exe	84
PID 3820 wrote to memory of 1044	3820	msedge.exe	84
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1900	3820	msedge.exe	85
PID 3820 wrote to memory of 1604	3820	msedge.exe	86
PID 3820 wrote to memory of 1604	3820	msedge.exe	86
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87
PID 3820 wrote to memory of 4164	3820	msedge.exe	87

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument C:\Users\Admin\AppData\Local\Temp\c06b7c40fa8c10dcdd47eb75738a189a_JaffaCakes118.html
1⤵
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:7 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=92.0.4515.131 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 "--annotation=prod=Microsoft Edge" --annotation=ver=92.0.902.67 --initial-client-data=0xfc,0x100,0x104,0xd8,0x108,0x7fffee3946f8,0x7fffee394708,0x7fffee394718
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --gpu-preferences=UAAAAAAAAADgAAAQAAAAAAAAAAAAAAAAAABgAAAAAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2176 /prefetch:3
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --service-sandbox-type=utility --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3292 /prefetch:1
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=3308 /prefetch:1
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=4696 /prefetch:1
  2⤵
  PID:3600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=6120 /prefetch:1
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5956 /prefetch:1
  2⤵
  PID:1228
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=7040 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5584 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5284 /prefetch:1
  2⤵
  PID:1988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --lang=en-US --disable-client-side-phishing-detection --instant-process --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --no-v8-untrusted-code-mitigations --mojo-platform-channel-handle=5872 /prefetch:1
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --field-trial-handle=2072,15649764135627985197,14229716155604412094,131072 --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=4318 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --gpu-preferences=UAAAAAAAAADoAAAQAAAAAAAAAAAAAAAAAABgAAAEAAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAHgAAAAAAAAAeAAAAAAAAAAoAAAABAAAACAAAAAAAAAAKAAAAAAAAAAwAAAAAAAAADgAAAAAAAAAEAAAAAAAAAAAAAAADQAAABAAAAAAAAAAAQAAAA0AAAAQAAAAAAAAAAQAAAANAAAAEAAAAAAAAAAHAAAADQAAAAgAAAAAAAAACAAAAAAAAAA= --mojo-platform-channel-handle=5660 /prefetch:2
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2748

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:4916

C:\Windows\System32\CompPkgSrv.exe
C:\Windows\System32\CompPkgSrv.exe -Embedding
1⤵
PID:2332

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
f9664c896e19205022c094d725f820b6

SHA1
f8f1baf648df755ba64b412d512446baf88c0184

SHA256
7121d84202a850791c2320385eb59eda4d697310dc51b1fcd4d51264aba2434e

SHA512
3fa5d2c68a9e70e4a25eaac2095171d87c741eec2624c314c6a56f4fa390d6319633bf4c48b1a4af7e9a0451f346beced9693da88cfc7bcba8dfe209cbd1b3ae

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat

Filesize
152B

MD5
847d47008dbea51cb1732d54861ba9c9

SHA1
f2099242027dccb88d6f05760b57f7c89d926c0d

SHA256
10292fa05d896a2952c1d602a72d761d34bc776b44d6a7df87e49b5b613a8ac1

SHA512
bd1526aa1cc1c016d95dfcc53a78b45b09dde4ce67357fc275ab835dbe1bb5b053ca386239f50cde95ad243a9c1bbb12f7505818577589beecc6084f7b94e83f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
120B

MD5
25e6ed7abe7f1b2f3dd87f5e4862d97f

SHA1
ce18925e415cd73ba35756e6ede5e40ce16a86dd

SHA256
d9d657984601de3a5db8459a89ce645d3455ebb51e3ece4dd6b2e0c61febdca7

SHA512
b3b18067b0c68cd0a1fd9a5b411a9bb69fc25204853b62030986d5c1337a2f45760f3a482cd0fc39c8eef830813c5412bf1e6a2c7ab428c3c2a5554e4e3e56f5

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index

Filesize
144B

MD5
76b1665a25e8e2884da2b5598fb89f56

SHA1
4feda95686c0e20967d8ef0bafa93693d705120b

SHA256
b97398e987ac2863f7630f7d0a97f5b5cd4f2b20ce6caf0756d1289a5c2ca1bb

SHA512
6d46fff76eb8e17d9729cb9de1bbb7313ee2769e164896fe691ac8a58f762879988fbd5482a5e2b41b4683e7da40753fc20074bf5b3ab9c3c08886325061dd6f

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network Persistent State

Filesize
1KB

MD5
0cca284210135369cdf4edbd79d683ac

SHA1
54dd5f741ec81c558fdc1e872d453fb66329f92c

SHA256
e995b29567955e66a861d8739a059887e4e79d7b654e4f5657a9b0bc280095ca

SHA512
e0534c3c57706844f690ebd0fb0a08481b822b2aad0a1e08d67ed9cb49431900d05265b5202426332ad4bff4ca978aa3a0efdc00450430277506d54043e2e282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
6KB

MD5
0327ef321b78f94b9200ac08b95de9f3

SHA1
1cc27410f722debc86dac4c2969a2e459247aefd

SHA256
0099915229e504c2d4497059b3e90cbed454d090ef7b4ba0d30a70412fa10ad6

SHA512
e5e9eecbee0d6bcf31b0db4bc865b15d0fa08ce100339aa00891412846aca9bd988be884d59f517f208a78670c3e0963ea802518fce88f728771fb2356250f58

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
5KB

MD5
68f8ce4e86ae99674b3bf19ad45aa9ff

SHA1
07a795d2d80e786bd9fcff5ec158e3bd2990c4f2

SHA256
3a65611f11577ef3326bbbef936a8d190406ba34cf64f9753c7633a9e7707d07

SHA512
7a63c6f3cb53e523acca3d5ad6d421e06b43ab506f32da05d010a2d03f5594474e26065440f8446be26f79939db9db7e63d1b52bffbd3bd3df6b453fb7984f62

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
1c0bad2570a894f34bac9dbe8a878c61

SHA1
9a2828eaa2232e236e9ecc92b12199ba1f40f160

SHA256
a0369231caf33d12450773b0383db1f201a1846482fdc3ee7a2da183be8b1e12

SHA512
60477863c7041e913ea976ff5c7063d3d3fa5cc5a9068ec98bafbdad7467437441bda396fec4ddddd650b0db01e4afa863b94b77aaa649fa67d11806f3f827bc

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences

Filesize
7KB

MD5
ed5a0684adc035146f24e882d50d7ef3

SHA1
e1e4ede47808b716d510e1c1e0b873c9b07eacec

SHA256
53585effef236fa0be07a7212759ec63ed4e513b5611615b9062751d1b36a56d

SHA512
87ff437f131531c40b23230b261f19f5adc83c96f043bda5f58acde88a94ee4fa633f8e2d8b4ce7a3f8664f03132e51126ed989d352faaab8eb26aca5e861fa4

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\data_reduction_proxy_leveldb\CURRENT

Filesize
16B

MD5
6752a1d65b201c13b62ea44016eb221f

SHA1
58ecf154d01a62233ed7fb494ace3c3d4ffce08b

SHA256
0861415cada612ea5834d56e2cf1055d3e63979b69eb71d32ae9ae394d8306cd

SHA512
9cfd838d3fb570b44fc3461623ab2296123404c6c8f576b0de0aabd9a6020840d4c9125eb679ed384170dbcaac2fa30dc7fa9ee5b77d6df7c344a0aa030e0389

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State

Filesize
10KB

MD5
39a4c2f1a83d2d6e111f384b73b543ab

SHA1
7e9e83f48e9a7381015fcaa6cf876a03161fc2bd

SHA256
269817c38c7ad6f5c518996b3a9ced296027b85160704cc4a8a426aeeb0e8317

SHA512
2c1d2be082a034e78cc732f9acfaa72ff08e3fb2659e76ecb63ac22d089fcdb060285e6d6d1edf160e21c20a72a239e488475f29c19df0862315e4ad889d9470

Download Submit